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17 (U) OTHERWISE ILLEGAL ACTIVITY (OIA) 


17.1 (U) Overview 

(U//FOUO) Otherwise Illegal Activity (OIA) is conduct in the course of duties by an FBI 
employee (to include an undercover employee (UCE)) or a confidential human source (CHS) 
which constitutes a crime under local, state, or federal law if engaged in by a person acting 
without authorization- OIA can be authorized for an FBI employee or CHS to obtain information 
or evidence necessary for the success of an investigation under the following limited 
circumstances: (i) when that information or evidence is not reasonably a vailable without i 

narticination in the OIA I I 

|or (iii) when necessary to prevent serious bodily injury 

or death- Certain types of OIA cannot be authorized, such as participation in conduct that would 
constitute an unlawful investigative technique (e.g., an illegal wiretap) or participation in an act 
of violence. In this context, "participation in an act of violence" does not include acts taken in 
self-defense and defense of others by the FBI employee or CHS because such actions would not 
be illegal 

17.2 (U) Purpose and Scope 

(U//FOUO) The use of OIA may be approved in the course of undercover activities or operations 
that involve an FBI employee or that involve use of a CHS. When approved, OIA should be 
limited or minimized in scope to only that which is reasonably necessary under the 
circumstances including the duration and geographic area to which approval applies, if 
appropriate. 

17.3 (U//FOUO) OIA in Undercover Activity 

(U//FOUO) General : The use of the undercover method is discussed in the DIOG Section 
1 8.6. 1 3. OIA is often proposed as part of an undercover scenario or in making the initial 
undercover contacts before the operation is approved. Specific approval for OIA must be 
obtained in the context of these undercover activities or operations in addition to general 
approval of the scenario or the operation. 

(U//FOUO) OIA by an FBI employee in an undercover operation relating to activity in violation 
of federal criminal law that does not concern a threat to the national security or foreign 
intelligence: must be approved in conformity with The Attorney General's Guidelines on FBI 
Undercover Operations ( AGG-UCOl Approval of OIA in conformity with the AGG-UCO is 
sufficient and satisfies any approval requirement that would otherwise apply under the AGG- 
Dom. Additional discussion is provided in the Field Guide for FBI Undercover and Sensitive 
Operations - A Special Agent in Charge (SAC) may approve the OIA described in subsection 
17.5. 


A) (U//FOUO) When a UCE provides goods and service (reasonably unavailable to the subject 
except as provided by the United States government) that facilitate a felony, or its equivalent 
under federal, state, or local law, it is a sensitive circumstance. In these sensitive 
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circumstances, additional authorization by an Assistant Director is required after review by the 
Criminal Undercover Operations Review Committee (CUORC). 

B) (U//FOUO) Participation in otherwise illegal activity that involves a significant risk of 
violence or physical injury requires authorization by the Director, Deputy Director, or 
designated Executive Assistant Director after review by the CUORC. 

(U//FOUO) OIA by an FBI employee in an undercover operation (UCO) relating to a threat to 
the national security or foreign intelligence collection must conform to the AGG-Dom and the 
FBFs National Security Undercover Operations Policy Implementation Guide (NSUCOPG). The 
Department of Justice (DOJ) National Security Division (NSD) is the approving component for 
OIA that requires approval beyond that authorized for SAC approval described in DIOG 
subsection 1 7.5, below. However, as authorized by the Assistant Attorney General for NSD, 
officials in other DOJ components may approve OIA in such investigations. 

17.4 (U//FOUO) OIA by a Confidential Human Source (CHS) 

(U//FOUO) OIA by a CHS must be approved in conformity with the AGG-CHS and the FBI 
CHSPG. 

17.5 (U//FOUO) Approval of OIA by a Special Agent in Charge (SAC) - Not 

INCLUDING MATERIAL SUPPORT OF TERRORISM 

(U//FOUO) An SAC may authorize the following OIA for an FBI employee when consistent 
with other requirements of this section, the AGG-Dom, the AGG-UCO, and other FBI policy 
unless otherwise indicated. Except for subsections A, B, and E below, the following OIA 
activities require CDC review prior to SAC approval, unless otherwise indicated: 

A) (U//FOUO) Otherwise illegal activity that would not be a felony under federal, state, local, or 
tribal law; 

B) (U//FOUO) Consensual monitoring, even if a crime under state, local, or tribal Jaw; 



a) (U//FOUO) The law of the state or territory where the monitoring will take place will 


govern whether OIA approval is needed. 
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4) (U//FOUO) Other approvals for the consensual monitoring may apply such as those 
required when the consensual monitoring involves a sensitive monitoring circumstance. 

See DIOG Section 18.6.1.6.3. 

C) (U//FOUO) The controlled purchase, receipt, delivery, or sale of drugs, stolen property, or 
other contraband; 

D) (U//FOUO) The payment of bribes; 

(U//FOUO) Note : the payment of bribes and the amount of such bribes in a public corruption 
matter may be limited by other FBI policy (see the Public Corruption PG and Confidential 
Funding PG); 

E) (U//FOUO) The making of false representations in concealment of personal identity or the true 
ownership of a proprietary; and 

F) (U//FOUO) Conducting a money laundering transaction or transactions involving an aggregate 
amount not exceeding $1 million. 

(U//FOUO) The field office should notify the appropriate FBIHQ operational division and OGC 
of any OIA proposed activity that in the judgment of the approving official may expose 
employees or others to significant personal safety risks, create a risk of civil liability, result in 
adverse publicity, or raise any other sensitive operational concern. As a matter of FBI policy, 
“judgment” means that the decision of the authorizing official is discretionary. 

(U//FOUO) An SAC may not authorize a violation of export control laws or laws that concern 
the proliferation of weapons of mass destruction during an investigation relating to a threat to the 
national security or foreign intelligence collection. 
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17.6 (U//FOUO) OIA Related to| 

| pNVESTIGATIONS 


b7 


(U//FOUO) In accordance with Part V.C.3 of the AGG-Dom, the Director of the FBI and the 
Assistant Attorney General for the NSD of the DOJ established the fo llowing policy concerning 
OIA as it relates to| investigations (see EC dated 

01/16/2009, 319W-H0-A14S7^-O(iC Serial 



B) (U//FOUO) NSD has represented that, except in exceptional circumstances, NSD shall act 
upon such an oral request within 24 hours and shall, within 72 hours, provide the FBI 
documentation of the authorization, including any terms and conditions. 

C ) (U//FOUQll I 


D ) (U//FOUO) Except in exceptional circum stances, any request for approval of OIA that j | 
| l other than those described in paragraph A, must be 

made in writing to NSD. 

(U//FOUO) Any questions about this policy or its implementation should be directed to OGC, 
National Security Law Branch, Counterterrorism Law Units. 

17.7 (U//FOUO) Standards for Review and Approval of OIA 


(U//FOUO) No official may recommend or approve participation by an FBI employee in OIA 
unless the participation is justified: 

A) (U//FOUO) To obtain information or evidence necessary for the. success of the investigation 
and not reasonably available without participation in the otherwise illegal activity; 

B) (U//FOUO 

C) (U//FOUO) To prevent death or serious bodily injury. 

17.8 (U) OIA NOT AUTHORIZED 


or 


fo7E 


(U//FOUO) The following activities may not be authorized as OIA: 

A) (U//FOUO) Directing or participating in acts of violence; 

(U//FOUO) Note: Self-defense and defense of others. FBI employees are authorized to engage 
in any lawful use of force, including the use of force in self-defense or defense of others in the 
lawful discharge of their duties. 
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B) (U//FOUO) Activities or investigative methods that cannot be authorized because they 

are prohibited by law, including activities that would violate protected constitutional or federal 
statutory rights in the absence of a court order or warrant such as illegal wiretaps and searches. 
For example, approving a non-consensual, non-emergency wiretap without a court order; 
approving the search of a home without a warrant or an exception to the warrant requirement, 
etc. 

17.9 (U) Emergency Situations 

(U//FOUO) Without prior approval, an FBI employee may engage in OlA that could be 
authorized under this section only if necessary to meet an immediate threat to the safety of 
persons or property or to the national security, or to prevent the compromise of an investigation 
or the loss of a significant investigative opportunity. In such a situation, prior to engaging in the 
OIA, every effort should be made by the FBI employee to consult with the SAC, and by the SAC 
to consult with the United States Attorney's Office (USAO) or appropriate DOJ Division where 
the authorization of that office or division would be required unless the circumstances preclude 
such consultation. Circumstances in which OIA occur pursuant to this paragraph without the 
authorization required must be reported as soon as possible to the SAC, and by the SAC to 
FBIHQ and to the USAO or appropriate DOJ Division. 
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18 (U) INVESTIGATIVE METHODS 


18.1 (U) Overview 

18 . 1.1 (U) Investigative Methods Listed by Sub-Section Number 

(U) The following investigative methods are listed by DIOG Sub-Section number: 

18.5.1 (U) Public information, 

18.5.2 (U) Records or information - FBI and DOJ. 

18.5.3 (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. 
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18.5.4 (U) On-line services and resources. 

18.5.5 (U) CHS use and recruitment. 

18.5.6 (U) Interview or request information from the public or private entities. 

18.5.7 (U) Information voluntarily provided by governmental or private entities. 

18.5.8 (U) Physical Surveillance (not requiring a court order). 

1 8.5.9 (U) Grand jury subpoenas - for telephone or electronic mail subscriber information only. 

18.6.1 (U) Consensual monitoring of communications, including electronic communications. 

18.6.2 (TTl Intercepting the communications of a computer trespasser. 

18.6.3 (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. 

18.6.4 (U) Administrative subpoenas. 

18.6.5 (U) Grand jury subpoenas. 

18.6.6 (U) National Security Letters. 

18.6.7 (U) FISA Order for business records. 

18.6.8 (U) Stored wire and electronic communications and transactional records. 

18.6.9 (U) Pen registers and trap/trace devices. 

18.6.10 (U) Mail covers. 

18.6.1 1 (U) Polygraph examinations. 

18.6. 12 (U) Searches - without a warrant or court order. 
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18.6.13 (U) Undercover operations. 

18.7.1 (U) Searches - with a warrant or court order. 

18.7.2 (U) Electronic surveillance - Title III. 

18.7.3 (U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). 

18 . 1.2 (U) INVESTIGA TIVE METHODS LISTED BY NAME (ALPHABETIZED) 

(U) The following investigative methods are listed alphabetized by DIOG name: 

(U) Administrative subpoenas. (Section 18.6.4) 

(U) CHS use and recruitment. (Section 18.5.5) 

(U) Closed-circuit television/video surveillance, direction Finders, and other monitoring devices. 
(Section 18.6.3) 

(U) Consensual monitoring of communications, including electronic communications. (Section 
18.6.1) 

(U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). (Section 18.7.3) 

(U) Electronic surveillance - Title III. (Section 18.7.2 ) 

(U) FISA Order for business records. (Section 18.6.7) 

(U) Grand jury subpoenas. (Section 18.6.5) 

(U) Grand jury subpoenas - for telephone or electronic mail subscriber information only in Type 
1 & 2 Assessments. (Section 18.5.9) 

(U) Information voluntarily provided by governmental or private entities. (Section 18.5.7) 

(U) Intercepting the communications of a computer trespasser. (Section 18.6.2) 

(U) Interview or request information from the public or private entities. (Section 18.5.6) 

(U) Mail covers. (Section 18.6.10) 

(U) National Security Letters. (Section 18.6.6) 

(U) On-line services and resources. (Section 18.5.4) 

(U) Pen registers and trap/trace devices. (Section 18.6.9) 

(U) Physical Surveillance (not requiring a court order). (Section 18;5.8) 

(U) Polygraph examinations. (Section 18.6.1 1) 
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(U) Public information. (Section 18.5.1) 

(U) Records or information - FBI and DOJ. (Section 1 8.5.2 ) 

(U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(Section 18.5.3) 

(U) Searches - without a warrant or court order. (Section 18.6.12) 

(U) Searches - with a warrant or court order. (Section 18.7.1) 

(U) Stored wire and electronic communications and transactional records. (Section 18.6.8) 

(U) Undercover Operations. (Section 18.6.13) 

18 . 1.3 (U) General Overview 

(U//FOUO) The conduct of Assessments, Predicated Investigations (Preliminary Investigations 
and Full Investigations) and other activities authorized by the Attorney General’s Guidelines for 
Domestic FBI Operations (AGG-Dom) may present choices between the use of different 
investigative methods (formerly investigative “techniques”) that are each reasonable and 
effective based upon the circumstances of the investigation, but that are more or less intrusive, 
considering such factors as the effect on the privacy and civil liberties of individuals and the 
potential damage to reputation. The least intrusive method if reasonable based upon the 
circumstances of the investigation is to be used in such situations. However, the choice of 
methods is a matter of judgment. The FBI is authorized to use any lawful method consistent with 
the AGG-Dom, even if intrusive, where the degree of intrusiveness is warranted in light of the 
seriousness of a criminal or national security threat or the strength of the information indicating 
its existence, or in light of the importance of the foreign intelligence sought to the United States’ 
interests. (AGG-Dom, Part I.C.2.) 

(U) The availability of a particular investigative method in a particular investigation may depend 
upon the level of investigative activity (Assessment, Preliminary Investigation, Full 
Investigation, and Assistance to Other Agencies). 

18.2 (U) Least Intrusive Method 

(U) The AGG-Dom requires that the "least intrusive" means or method be considered and — if 
reasonable based upon the circumstances of the investigation — used to obtain intelligence or 
evidence in lieu of more intrusive methods. This principle is also reflected in Executive Order 
12333, which governs the activities of the United States intelligence community (USIC). The 
concept of least intrusive method applies to the collection of intelligence and evidence. 

(U) Selection of the least intrusive means is a balancing test as to which FBI employees must use 
common sense and sound judgment to effectively execute their duties while mitigating the 
potential negative impact on the privacy and civil liberties of all people encompassed within the 
Assessment or Predicated Investigation, including targets, witnesses, and victims. This principle 
is not intended to discourage investigators from seeking relevant and necessary intelligence, 
information, or evidence, but rather is intended to encourage investigators to choose the least 
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intrusive — yet still reasonable — means from the available options to obtain the material. 
Additionally, FBI employees should operate openly and consensually with United States persons 
(USPERs) to the extent practicable when collecting foreign intelligence that does not concern 
criminal activities or threats to the national security. 

(U) DIOG Section 4.4 describes the least intrusive methods concept and the standards to be 
applied by FBI employees. 

18.3 (U) Particular Investigative Methods 

(U//FOUO) All lawful investigative methods may be used in activities under the AGG-Dom as 
authorized by the AGG-Dom. Lawful investigative methods include those investigative methods 
contained in this DIOG as well as additional investigative methods and resources authorized in 
other FBI policy and guidance (for example, future additions to DIOG Sections 18, as well as 
Policy Implementation Guides). In some instances the authorized investigative methods are 
subject to special restrictions or review or approval requirements. (AGG-Dom, Part V.A.) 

183.1 (U) Use of Criminal Investigative Methods in National Security 

Investigations 

(U//FOUO) Because national security investigations may implicate criminal issues as well, the 
availability of criminal investigative methods should be considered when appropriate. However, 
any use of criminal investigative methods should be closely coordinated with FBIHQ, both 
operational units and the NSLB, prior to any anticipated use of this criminal investigative 
process. The NSLB maintains liaison with DOJ OI respecting the use of FISA authorized 
investigative methods in national security investigations. 

18.4 (U) Information or Evidence Obtai ned in Assessments and Predicated 
Investigations 

(U) The use, retention and/or dissemination of information obtained during authorized 
investigations must comply with the AGG-Dom and the DIOG. If the originator of information 
reported to the FBI characterizes an individual, group, or activity in a certain way, and that 
characterization should be documented for completeness of the FBI record, the FBI record (i.e., 
302, EC, LHM) should reflect that another party, and not the FBI, is the originator of the 
characterization. 

(U) During the course of an Assessment or Predicated Investigation, FBI employees lawfully 
may collect or passively receive items of evidence or intelligence from a variety of sources. 
Experience has demonstrated that the relevance of every item of evidence or intelligence 
collected or received is not always apparent at the time it is obtained. Accordingly, FBI 
employees have wide latitude to establish or determine the relevance of information as the 
Assessment or investigation develops. Nevertheless, as a matter of administrative efficiency and 
sound business practice, if an FBI employee obtains an item of evidence which clearly is not 
relevant to the Assessment or investigation and there is no foreseeable future evidentiary or 
intelligence value of the item for the FBI or the USIC, the item should be returned or destroyed 
as circumstances warrant, with a record of the disposition documented in the file or on the FD-71 
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or Guardian (FD-71a). In the alternative, such item of evidence may be sequestered in the 
investigative file. If it is later determined that the item of evidence is relevant, the item may be 
used in the investigation upon such determination. The determination of relevancy will be made 
on a case-by-case basis with supervisory direction and may include consultation with the 
appropriate federal prosecuting office and/or the Chief Division Counsel (CDC) or the Office of 
the General Counsel (OGC). This policy does not supersede Sections 18.6.4.1.5 (Administrative 
Subpoenas); 18.6.5.1 (Federal Grand Jury Subpoena); 18.6.6.1.7 (National Security Letters); or 
18.6.7.1.6 (FISA Order for Business Records), or any requirement imposed by statute, regulation 
or other applicable law. 

18.5 (U) Authorized Investigative Methods in Assessments 


(U) See AGG-Dom, Part II.A.4. 

(U//FOUO)r lFD-71 or in Guardian. \ 


b 


(U) In conducting an Assessment, only the following investigative methods are authorized: 

A) (U) Public information. (See Section 18.5.0 

B) (U) Records or information - FBI and DOJ. (See Section 18.5.2) 

C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(See Section 18.5.3) 

D) (U) On-line services and resources. (See Section 18.5.4) 

E) (U) CHS use and recruitment. (See Section 18.5.5 ) 

F) (U) Interview or request information from the public or private entities. (See Section 18.5.6) 

G) (U) Information voluntarily provided by governmental or private entities. (See Section 18.5.7) 

H) (U) Physical Surveillance (not requiring a court order). (See Section 1 8.5.8) 

T) (U//FOUO) Grand jury subpoenas - for telephone or electronic mail subscriber information 
only (during a Type 1 & 2 Assessment) (See Sections 18.5.9 and 18.6.5) 

(U//FOUO) In Assessments, supervisory approval is required prior to use of the following 
jnvesti gatiyejnet^ certain interviews, tasking of a CHS, and nhvsiral ^nrvpiUan rp nni- ronnirino 
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18.5.1 (U) Investigative Method: Public Information ("Publicly Available 

Information ") 

(U) See AGG-Dom, Part II.A.4.a and Part VII.L. 

18.5.1.1 (U] Scope 

(U//FOUO) Public information is “Publicly Available Information” that is: 

A) (U) Published or broadcast for public consumption; 

B) (U) Available on request to the public; 

C) (U) Accessible on-line or otherwise to the public; 

D) (U) Available to the public by subscription or purchase; 

E) (U) Made available at a meeting open to the public; 

F) (U) Obtained by visiting any place or attending an event that is open to the public (e.g., public 
places); or 

G) (U) Observed, heard, smelled, detected or obtained by any casual observer or member of the 
public and does not involve unconsented intrusion into private places. 

(U//FOUO) The phrase “observed, heard, smelled, detected or obtained by any casual 
observer or member of the public” includes, for example, plain view observations; 
overhearing a conversation taking place at an adjacent table in a public restaurant; odor 
detection (by a person, drug dog, or technical device) emanating from a vehicle, in a public 
place, or from locations to which the employee has gained lawfiil access; searching property 
that has been intentionally abandoned, including property discarded in public trash containers 
or common dumpsters (but does not include a 6t trash cover” as set forth in DIOG Section 
18.6.12). 

(U//FOUO) The following are examptes: 

1 ) (U) Viewing the vehicle identification number or personal property that is exposed to 
public view and may be seen when looking through the window of a ear that is parked in 
an area that is open to and accessible by members of the public; 

2) (U) The examination of books and magazines in a book store or the purchase of such items. 
See Maryland v. Macon, 472 U.S. 463 (1985); and 

3) (U) A deliberate overflight in navigable air space to photograph marijuana plants is not a 
search, despite the landowner’s subjective expectation of privacy. See California v. 

Ciraolo, 476 U.S. 207 (1986). 

(U//FOUO) Note: Consent Searches are authorized in Assessments, as well as in Predicated 
Investigations. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 
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18.5.1.2 (U) Application 



18.5.1.3 (U) Approval 

(U//FOUO) Supervisory approval is not required for use of this method, except for the special 
rule for attending a religious service, even if it is open to the public. (See DIOG Section 
18.5.1.3.1) 

18,5.1.3.1 (U//FOUO) Special Rules: "Special Rule for Religious Ser vices" and 

"Special Rule for Other Sensitive Organiza tions” 


18.5.1.3.1.1 (U//FOUO) Special Rule for Religious Services - regardless of 


WHETHER IT IS OPEN TO THE GENERAL PUBLIC 


| An FBI employee attending a religious service overtly 
must have SSA approval. Higher approvals may be required under certain circumstances, such 
as attendance that rises to the level of UDP (see DIOG Section 16^1 I 


B) (U//FOUO) In Predicated Investigations ] | 

| |An FBI employee attending a religious service overtly must have SSA 

approval. Higher approvals may be required under c ertain circumstances, such as attendance 
that rises to the level of UDP (see DIOG Section 16)1 

I |(see DIOG Section 18.6.13). 1 1 


18.5.1.3.1.2 (U//FOUO) Special Rule for Other Sensitive Organizations 



18.5.1.4 (U) Use/Dissemination 


(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 


b 7 E 
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18.5.2 (U) Investigative Method: Records or Information - FBI and 

Department of Justice (DOJ) 

(U) See AGG-Dom, Part II.AAb. 


18.5.2.1 (U) Scope 

(U//FOUO) An FBI employee may access and examine FBI and other DOJ records and may 
obtain information from any FBI personnel or other DOJ personnel. Access to certain FBI 
records may be restricted to designated FBI personnel because of the sensitive nature of the 
information in the record, the classification of the record, or the tool used to gather the 
information contained in the record. These include, but are not limited to: FBI records 
concerning human source identification; espionage investigations; code word; other 
compartmented information; records that include raw FISA collections; and Rule 6(e) 
material. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 


18.5.2.2 (TJ) Application 


(U//FOUQ)[ 


b 7 


18.5.2.3 (U) Approval 

(U//FOUO) Supervisory approval is not required to use this method, except that if the use of 
records constitutes pattern-based data mining under the Federal Data Mining Reporting Act of 
2007, it must be reviewed and approved according to Section 18.5.2.4 below. 

18.5.2.4 (U) Pattern-Based Data Mining 

(U//FOUO) As used here, pattern-based data mining (PBDM) means queries or other analysis 
of electronic databases using two or more search criteria designed to discover or locate a 
predictive pattern or anomaly indicative of terrorist or criminal activity on the part of any 
individual or individuals (as defined in Corporate Policy Directive 03 10D). Any such analysis 
based solely on racial, ethnic, national origin or religious characteristics is strictly prohibited. 

(U//FOUO) For purposes of this requirement, pattern-based data mining does not include 
activities using one or more personal identifiers to identify an individual or analysis designed 
to discover links between a specific subject and unknown individuals or entities, even if the 
subject’s actual identity is not yet known. Pattern-based data mining does not include queries 
or analysis designed solely to identify potential human sources of intelligence nor does it 
include activities designed to identify an i ndividual or individuals associated with crimina l or 
terrorist activity that has already occurredi ~| b 
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Hn contrast, database queries using criterial I ^ 

I because the queries are being used to investigate a crime 
that has already occurred. Queries designed to identify individuals or entities who have had 
contact with a specific individual are not pattern-based data mining; rather, such queries are 
subject-based data mining, even if the specific individual’s actual identity is presently 
unknown. 

(U//FOUO) The majority of data analysis performed during FBI Assessments and Predicated 
Investigations is based on specific individuals or events and therefore does not constitute 
pattern-based data mining because it is either link analysis or is not predictive of future 
behavior. 

(U//FOUO) A Privacy Threshold Analysis (PTA) for pattern-based data mining must be 
completed and forwarded to the Privacy and Civil Liberties Unit, OGC. See the OGC Privacy 
PG for additional details. 

(U//FOUO) The Sensitive Operations Review Committee (SORC) must also receive notice of 
any proposal to use pattern-based data mining as defined above. Additionally, pursuant to the 
Federal Agency Data Mining Reporting Act of 2007. 11 the FBI must advise the DOJ of all 
agency initiatives that involve the use of PBMD, so that those activities may be included in 
the Department’s annual report to Congress. (See CPD 031 0D, fc ’Pattem-based Data Mining 
Reporting Requirements) . 

18.5.2.5 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 

(U//FOUO) The request for the records and the records received from DOJ and used during an 
Assessment or Predicated Investigation must be maintained as nart of the annrnnriate file 


11 (U) 42 U.S.C. § 2000ee-3 
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18.53 (U) Investigative Method: Records or Information - Other Federal, 

State, Local, Tribal, or Foreign Government Agency 

(U) See AGG-Dom, Part II.A.4.C. 


18.5.3.1 (U) Scope 

(U//FOUO) An FBI employee may access and examine records maintained by, and request 
information from, other federal, state, local, or tribal, or foreign governmental entities or 
agencies. When requesting information using this authority, care must be taken to ensure the 
entity to which the request is made understands that it is not compelled to provide such 
information or create a new record to assist the FBI. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.3.2 (U) Application 

18.5.3.3 (U//FQUof 1 

io 

(U//FOUO)r I 


(U//FOUO) Requests to other Federal Aeencies: The FBI may request another federal 
agency to disclose Privacy Act-protected records pursuant to the other agency’s “routine 
uses” (5 U.S.C. § 522a[b][3]) or through a written request for a law enforcement purpose (5 
U.S.C. § 522a[b][7]). Such written requests (for a law enforcement purpose) pursuant to 5 
U.S.C. § 522a(b)(7) may be made by the Director or his designee, provided that such 
authority may not be delegated below the Section Chief level (28 C.F.R. § 16.40[c]; OMB 
Guidelines, 40 Fed. Reg. at 28,955). Pursuant to these provisions, the Director hereby 
delegates his authority to request from federal agencies information and records otherwise 
protected from disclosure by the Privacy Act, at FBIHQ, to all Section Chiefs and above, and 
in the field, to all SACs and ADICs. This authority may not be redelegated to a person below 
the rank of SAC in the field and SC in FBIHQ. 

(U//FOUO) Requests to Foreign Aeencies : Requests for records or information from a 
foreign government entity or agency must be appropriately coordinated through the applicable 
FBI Legat office, International Operations Division (IOD), INTERPOL, relevant FBIHQ 
operational division, and/or DOJ Office of International Affairs, as necessary. Direct contact 
with foreign government agencies is authorized in certain circumstances, such as an imminent 
threat situation. 
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(U//FOUO) If the analysis of records obtained in this manner constitutes PBMD under the 
Federal Data Mining Reporting Act of 2007, it must be reviewed and approved according to 
Section 18.5.2.3, above. 



18.5.3.4 (U) Use/Dissemination 

(U//FOUO) The use and/or dissemination of information obtained by this method must 
comply with the AGG-Dom and DIOG Section 14. 


(U//FOUO) The request for the records and the records received from an outside entity and 
used during an 
appro priate file 
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18 . 5.4 (U) Investigative Method: On-Line Services and Resources 

(U) See AGG-Dom, Part II.A.4.d. 

18.5.4.1 (U) Scope 

(U//FOUO) An FBI employee may use any publicly available on-line service or resource 
including those that the FBI has obtained by subscription or purchase for official use, 
including services available only to law enforcement entities. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.4.2 (U) Application 

(U//FOUO) This investigative method may be used prior to opening an Assessment, in 
Assessments, Predicated Investigations, foreign intelligence collection investigations, and for 
assistance to other agencies. 

18.5.4.3 (U) Approval 

(U//FOUO) Supervisory approval is not required to use this method, although subscribing to 
or purchasing any new service or resource must be done according to FBI contracting 
procedures. 

(U//FOU O) Example: Publicly available on-line servic es nr rpsnnrr.es include, but are not 
limited toi l I l Onli ne resources that mav h e 

purchased by the FBI for official use include, hut are not limite d tr»- 1 I . 


18.5.4.4 (U) Use/Dissemination 

(U//FOUO) The use or dissemination, of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 

(U) See DIOG Appendix L - On-line Investigations for additional information. 
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18.5.5 (U) Investigative Method: CHS Use and Recruitment 

(U) See AGG-Dom, Part II.A.4.e. 

18.5.5.1 (U) Scope 

(U//FOUO) The FBI may use and recruit human sources in Assessments and Predicated 
Investigations in conformity with the AGG-Dom, Attorney nniH^im^c p^nat-Hina th g 

Use of FBI Confidential Human Sourc es (AGG-CHS). the FbJ I 

1 and the FBt | I 

I In this context, “use” means obtaining intormation from, tasking, or otherwise 
operating such sources. See AGG-Dom, Part VII, V. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.5.2 (U) Application 

(U//FOUO) This investigative method may be used in Assessments, Predicated Investigations, 
foreign intelligence collection investigations, and for assistance to other agencies when it is 
not otherwise prohibited by AGG-Dom, Part III.B.2. 

(U) When collecting positive foreign intelligence, the FBI must operate openly and 
consensually with an USPER, to the extent practicable. 

(U//FOUO) A CHS can be “used” in support of an Assessment and a Predicated Investigation 
or for the purpose of validating, vetting or determining the suitability of another CHS as part 
of an Assessment. 

18.5.5.3 (U) Approvals 

(U//FOUO) All investigative methods should be evaluated to ensure compliance with the 
admonition that the FBI should use the least intrusive method if reasonable based upon the 
circumstances of the investigation. That requirement should be particularly observed during 
an Assessment when using a CHS because the use of a CHS during an Assessment may be 
more intrusive than many other investigative methods. Use of a CHS in an Assessment should 
take place only after considering whether there are effective, less intrusive means available to 
obtain the desired information. The CHS must comply with all constitutional, statutory, and 
regulatory restrictions and limitations. In addition: 

A) (U//FOUO) CHS use and direction must be limited in focus and scope to what is necessary to 

accomplish t he authorized purpose and objective of the A repayment nr Predicated 
Investigation,! 1 I 

■ ■ 1 

B) (U//FOUQ) During an Assessmen t ^ I 

I I see the Special Rule for Religious Services and the Spec ial 

Rule for Other Sensitive Organizations below) only to the extent that such information is 
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necessary to achieve the specific objective of the Assessment If such contact reveals 
information or facts about an individual, group or organization that meets the requirements to 
open a Predicated Investigation, a Predicated Investigation may be opened, as appropriate. 

C) (U//FOUO) Special Rule for Religious Services - regardless of whether it is open to the 
general public: 

1 ) (U//FOUO) In Assessments^ 


]An FBI employee attending a religious service 


overtly must have SS A approval. Higher approvals may be required under certain 
circumstances, such as attendance that rises to the level of UDP (see DIOG Section 1 6). 

i 1 

(}^IIY0\} O)Jr^redicatedJ nvestisations\ \ 


]An FBI employee attending a religious service overtly must have 


SSA approval. Higher approvals may be required under certain circumstances, such as 
attendance that rises to d ie level of UDP (see DIOG Section 16 | I 

| ""[ (see DIOG Section 18.6.13). 

D) (U//FOUO) Special Rule for Other Sensitive Organizations: 

1 ) (U//FOUQ) In Assessments: \ 



E ) (U//FOUO) Public Information:! ~~1 

I [which must be approved in accordance with DIOG 

Section 1 6)| I 



principle does not, however, eliminate the legal concept of a consent search or the doctrine of 
misplaced confidence. The doctrine of misplaced confidence provides that a person assumes 


th 7 E 


Jl;,7 




b7E 
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the risk when dealing with a third part 
n’s confidence! 


that the third 


it be a government agent and 



H) (U//FOUO) If there is any conflict between the ! l or any other PG and the 

DIOG, the DIOG controls. OGC, OIC and CPO should be immediately notified of any such 
conflict. 


18.5.5.4 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of infor mation obta ined by this method must comply 
with the AGG-Dom, DIOG Section 14, and the | ~| 
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18.5.6 (U) Investigative Method: Interview or Request Informa tion from 

the Public or Priva te Entities 
(U) See AGG-Dom, Part II.AAf; AGG-Dom, Part II.B.4. 

18.5.6.1 (U) Scope 

(U//FOUO) An interview is the questioning of an individual (to include a subject) in order to 
gather information that is pertinent to and within the scope of an authorized Assessment or 
Predicated Investigation. The initial questioning of a complainant is not an interview, nor is 
re-contacting a complainant to clarify information that was initially provided. Normally, an 
FBI employee should disclose the employee’s affiliation with the FBI and true purpose of the 
interview at the outset. The person being interviewed is voluntarily providing information and 
his/her Constitutional rights must be respected. FBI employees may not obtain a statement by 
force, threats, or improper promises. FBI employees have no authority to promise leniency or 
immunity from prosecution. Additionally, the interviewer should make reasonable efforts to 
obtain information that is accurate, relevant, timely, and complete. An interview may only 
elicit a description of how an individual exercises a right guaranteed by the First Amendment 
to the Constitution if such information is pertinent to and within the scope of an authorized 
activity; similarly, regardless of how such information is elicited, it may not be maintained in 
FBI files unless it is pertinent to and within the scope of an authorized activity. 

(U//FOUO) Nothing in this section prohibits asking for or accepting volunteered access to 
personal or real property. 

(U//FOUO) Note: Consent Searches” are authorized in Assessments, as well as in Predicated 
Investigations. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.6.2 (U) Application 

(U//FOUQ1 I 


18.5.6.3 (U) Voluntariness 

(U//FOUO) Information that is sought during an interview must be provided voluntarily. FBI 
employees may not obtain a statement by force, threats, or improper promises. FBI employees 
have no authority to promise leniency or immunity from prosecution. If, during a non- 
custodial interview, the interviewee indicates he or she wishes to consult an attorney, the 
interviewer should assess whether continuing the interview would negatively affect the 
voluntariness of any further information provided. In determining whether a statement has 
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been given voluntarily, courts evaluate a totality of the circumstances,” which may include 
consideration of the following factors: 

A) (U//FOUO) Whether the interviewee was notified of any charges against him/her or advised of 
his/her rights; 

B) (U//FOUO) The interviewee’s age, intelligence, experience, and physical condition; 

C) (U//FOUO) Whether there was any physical abuse or threats of abuse during the interview; 

D) (U//FOUO) The number of officers present and whether weapons were displayed during the 
interview; 

E) (U//FOUO) Whether threats or psychological pressure was used during the interview; 

F) (U//FOUO) Whether the interviewee was deprived of food, sleep, medication, or outside 
communication during the interview; 

G) (U//FOUO) The duration of the interview, and whether any trickery, ruse, or deception was 
used; and 

H) (U//FOUO) Whether there were any promises of leniency or other inducements made during 
the interview. 

(U//FOUO) See Sections 18.5.6.3.8, 18.5.6.3.9, and 18.5.6.4.13 below for additional 
considerations when interviewing juveniles. 

(U/FOUO) These factors are illustrative. The presence of any one or more of the factors 
mentioned above will not necessarily make a statement involuntary. 

18.5.6.4 (U) Approval / Procedures 

(U) With the exceptions discussed below, interviews do not require supervisory approval. 

1 8.5. 6.4 . 1 (U) Custodial Interviews 

(U//FOUO) An FBI employee must advise a person who is in custody of his/her Miranda 
rights, per form FD-395, before beginning an interview inside the United States with the 
exception of questioning reasonably prompted by a concern for public safety (discussed 
below). It is critical that the person understand his/her rights before questioning. By signing 
the FD-395, the defendant acknowledges that he/she has been advised of his/her rights and is 
willing to proceed without a lawyer present. 

(U//FOUO) A person is “in custody” for purposes of Miranda when his/her freedom of 
movement is significantly restricted. Custody can arise short of formal arrest when, judging 
from the totality of the circumstances, a reasonable person in the position of the interviewee 
would believe that he/she is in custody. A brief, temporary investigative detention is not 
custody provided it is reasonable in scope. In assessing whether a temporary detention is 
reasonable in scope and thus not custody for purposes of Miranda , factors to consider include 
the degree of force used to affect the detention, use of restraining devices and whether the 
individual was moved from the location of the stop. Employees can clarify custodial status by 
telling the person that he/she is not under arrest. 
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18.5.6.4.1.1 (U) Miranda Warnings Required 


(U//FOUO) Miranda warnings are required when a person: 

A) (U//FOUO) Has been arrested and is in federal, tribal, state, or local custody; 

B) (U//FOUO) Is significantly restricted in his freedom of movement to a degree normally 
associated with a formal arrest; or 

C) (U//FOUO) Regardless of custody, has previously been formally charged, prosecution is 
pending, and the subject matter of the interview concerns the pending charge. 

(U//FOUO) For the purposes of Miranda , an interview refers to express questioning and any 
words or actions that are reasonably likely to elicit an incriminating response. In a custodial 
interview, the individual must be advised of the names and official identities of the 
employee(s) conducting the interview, the nature of the inquiry, and provided Miranda 
warnings, per the FD-395 form, before being interviewed. After being advised of his/her 
rights, if an interviewee who is in custody, invokes the right to counsel and/or the right to 
remain silent, this must be honored and the interview must cease. However, once the advice 
of rights is provided and it is evident that the interviewee understood those rights, the 
interview may proceed until such time as the interviewee invokes a right. While an 
affirmative waiver, including signing a waiver portion of the FD-395 is preferred, it is not 
required. Once the interviewee invokes his/or her right to remain silent and/or right to 
counsel, the interview must immediately be terminated. The fact that the interviewee invoked 
the right to counsel and/or the right to remain silent should be recorded on the FD-395 and the 
form should be executed in all other respects. 

18.5.6.4.1.2 (U) Miranda Warnings not Required 

(U//FOUO) There are certain custodial interviews in which the protection Miranda provides 
against self-incrimination may not be served by reading the standard warnings and obtaining a 
waiver. In the following circumstances, Miranda warnings are not required for custodial 
interviews: 

A) (U//FOUO) standard booking questions; 

B) (U//FOUO) an interview of the incarcerated individual as a victim or witness in an unrelated 
matter that does not pertain to any pending charges against the interviewee; 

C) (U//FOUO) the public safety exception (discussed in more detail below); and 

D) (U//FOUO) in connection with arrests of operational terrorists inside the United States 
(discussed in more detail below). 

18.5.6.4.1.3 (U//FOUO) Public Safety Exception 


(U//FOUO) The warning and waiver of rights is not require d when questions are asked 
that are reasonably prompted by a concern for public safetv.l~ 
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situations where imminent threat(s) to the safety of law enforcement officers or 
members) of the public could be alleviated by questions necessary to neutralize the 
threat. 


18.5.6.4.1.4 (U//FOUO) Advice of Rights In Connection With Arrests of 
Operational Terrorists Inside the United States 12 

(U//FOUO) Identifying and apprehending suspected terrorists, interrogating them to 
obtain intelligence about terrorist activities and impending terrorist attacks, and lawfully 
detaining them so that they do not pose a continuing threat to our communities are critical 
to protecting the American people. The DOJ and the FBI believe that we can maximize 
our ability to accomplish these objectives by continuing to adhere to FBI policy regarding 
the use of Miranda warnings for custodial interrogation of operational terrorists 13 who 
are arrested inside the United States: 

A) (U//FOUO) If applicable, agents should ask any and all questions that are reasonably 
prompted by an immediate concern for the safety of the public or the arresting agents without 
advising the arrestee of his Miranda rights. 14 

B) (U//FOUO) After all applicable public safety questions have been exhausted, agents should 
advise the arrestee of his/her Miranda rights and seek a waiver of those rights before any 
further interrogation occurs, absent the exceptional circumstances described below. 

C) (U//FOUO) There may be exceptional cases in which, although all relevant public safety 
questions have been asked, agents nonetheless conclude that continued unwarned interrogation 
is necessary to collect valuable and timely intelligence not related to any immediate threat, and 
that the government’s interest in obtaining this intelligence outweighs the disadvantages of 
proceeding with unwarned interrogation. 15 


12 (U//FOUO) This guidance applies only to arrestees who have not been indicted and who are not known to 
be represented by an attorney. For policy concerning the interrogation of indicted defendants, see Section 
18.5.6.4.1; and for policy concerning contact with represented persons, see DIOG Section 18.5.6.4.5. 
13 (U//F0U0) For these purposes, an operational terrorist is an arrestee who is reasonably believed to be 
either a high-level member of an international terrorist group; or an operative who has personally conducted 
or attempted to conduct a terrorist operation that involved risk to life; or an individual knowledgeable about 
operational details of a pending terrorist operation. 

u (U//FOUO) The Supreme Court held in New York v. Quarles , 467 U.S. 649 (1984), that if law enforcement 
officials engage in custodial interrogation of an individual that is "reasonably prompted by a concern for the 
public safety," any statements the individual provides in the course of such interrogation shall not be 
inadmissible in any criminal proceeding on the basis that the warnings described in Miranda V Arizona , 384 
U.S. 436 (1966), were not provided. The Court noted that this exception to the Miranda rule is a narrow one 
and that "in each case it will be circumscribed by the {public safety} exigency which justifies it" 467 U.S. at 
657. 

1S (U//F0U0) The Supreme Court has strongly suggested that an arrestee’s Fifth Amendment right against 
self-incrimination is not violated at the time a statement is taken without Miranda warnings, but instead may 
be violated only if and when the government introduces an unwarned statement in a criminal proceeding 
against the defendant See Chavez v. Martinez, 538 U.S. 760, 769 (2003) (plurality op.); id. at 789 (Kennedy, J., 
concurring in part and dissenting in part); cf. also id. at 778-79 (Souter, J. ( concurring in the judgment); See 
also United States v. Patane, 542 U.S. 630, 641 (2004) (plurality opinion) (” [Violations [of the Fifth 
Amendment right against self-incrimination] occur, if at all, only upon the admission of unwarned statements 
into evidence at trial."); United States v. Verdugo-Urguidez, 494 U.S. 259, 264 (1990) ("[A] violation [of the 
Fifth Amendment right against self-incrimination] occurs only at trial.”). 
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(U//FOUO) in these exceptional cases, agents must seek SAC approval, which cannot be 
delegated, to proceed with an unwarned interrogation after the public safety questioning is 
concluded. The SAC must consult with FBIHQ (including OGC) and DOJ attorneys before 
granting approval. Presentment of an arrestee may not be delayed simply to continue the 
interrogation, unless the arrestee has timely waived prompt presentment 

(U//FOUO) The determination whether particular unwarned questions are justified on 
public safety grounds must always be made on a case-by-case basis based on all the facts 
and circumstances. In light of the magnitude and complexity of the threat often posed by 
terrorist organizations, particularly international terrorist organizations, and the nature of 
their attacks, the circumstances surrounding an arrest of an operational terrorist may 
warrant significantly more extensive public safety interrogation without Miranda 
warnings than would be permissible in an ordinary crim inal investigation. Depend ing on 
the facts, such interrogation might include, for example,! | 


(U//FOUO) As noted above, if there is time to consult with FBIHQ (including OGC) and 
Department of Justice attorneys regarding the interrogation strategy to be followed prior 
to reading the arrestee his Miranda rights, the field office should endeavor to do so. 
Nevertheless, the agents on the scene who are interacting with the arrestee are in the best 
position to assess what questions are necessary to secure their safety and the safety of the 
public, and how long the post-arrest interview can practically be delayed while 
interrogation strategy is being discussed. 

18.5.6.4.2 (U//FOUO) Miranda Warnings for Suspects in Custody Overseas 

(U//FOUO) The decision to use or not use Miranda warnings during an overseas custodial 
interrogation will have to be made on a case by case basis and weigh many factors. Overall, if 
there is a reasonable likelihood of a prosecution in a U.S. civilian criminal court of the person 
being interrogated while in custody overseas, agents should discuss with FBIHQ, FBI OGC, 
and DOJ whether warnings should be provided to the person being interrogated. Once the 
determination is made to provide Miranda warnings as part of an overseas custodial 
interrogation, if the person being interrogated invokes his right to remain silent or consult 
with an attorney, this invocation should be honored. If use of Miranda warnings is appropriate 
given the circumstances of the case, the following DOJ-approved modified waiver form 
should be used. The form is the Standard Advice of Rights for Suspects in Foreign Custody . 

18.5.6.4.3 (U) Constitutional Rights to Silence and Counsel under Miranda 

A) (U//FOUO) Silence: If a custodial interviewee invokes his/her right to remain silent, FBI 
employees should not attempt a subsequent interview until a significant period of time has 
elapsed (a two-hour period has been held to be significant) or the interviewee requests to be 
interviewed anew. In either case, an FBI employee will ensure that the interviewee is again 
advised of his/her Miranda rights and indicates that he/she understand those rights before 
further questioning. If the interviewee again asserts his/her right to remain silent or the right to 
counsel, questioning must cease at that time. Assertion of the right to silence, like assertion of 
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the right to counsel, must be unequivocal and unambiguous. A waiver of the right to remain 
silent occurs when an interviewee knowingly and voluntarily makes a statement; assertion of 
the right to remain silent requires more than mere silence in the face of questioning. This right, 
like the right to counsel, can be invoked at any time during custodial interrogation. Agents 
may continue questioning someone who has not dearly invoked his/her right to remain silent, 
but if the custodial interviewee asserts his/her right to silence, questioning must cease at that 
time. 

B) (U//FOUO) Counsel: If a custodial interviewee invokes his/her right to counsel, questioning 
must cease. FBI employees may not attempt a subsequent interview unless counsel is present, 
the custodial interviewee initiates contact, or there has been a break in custody of at least 14 
days. 

1) (U//FOUO) When a custodial interviewee who has invoked his/her right to counsel 
initiates a subsequent interview, an FBI employee must ensure that the interviewee is 
advised of and understands his/her Miranda rights before proceeding with the interview. 
Not every statement by a custodial interviewee can fairly be interpreted as initiating a 
subsequent interview. In order to constitute the initiation of an interview, the custodial 
interviewee must either directly request such or use words that are reasonably interpreted 
as expressing a desire to be interviewed. If the words used are ambiguous, the FBI 
employee should clarify the custodial interviewee’s intent by asking directly whether the 
custodial interviewee wants to be interviewed. The words and responses, if any, to such 
clarifying questions should be documented. General conversation by a custodial 
interviewee cannot be interpreted as indicating a desire to be interviewed and cannot be 
used standing alone to predicate a second interview after the right to counsel has been 
invoked. If the interviewee again asserts his/her right to counsel, or invokes his/her right to 
silence, questioning must cease at that time. 

2) (U//FOUO) When an uncharged and/or unrepresented interviewee who has previously 
invoked his/her right to counsel experiences a break-in-custody of at least 1 4 days, he/she 
may be approached for a subsequent interview. FBI employees, however, must ensure that 
the custodial interviewee is again advised of and waives his/her Miranda rights before 
proceeding with the interview. A break-in-custody for these purposes can occur even if an 
interviewee is continuously incarcerated. Questions as to what constitutes a break-in- 
custody should be directed to the CDC or OGC. 

3) (U//FOUO) Contact with a represented person outside the presence of his/her counsel may 
implicate state ethics rules for attorneys (AUSAs). Before making such contact, employees 
are encouraged to contact the CDC, OGC, or the US AO. Once a represented person has 
been charged, information may only be elicited from the person: 1) regarding an unrelated 
or uncharged matter or 2) when counsel is present. Questions as to whether an individual is 
in fact represented or may be questioned as to a particular matter should be directed to the 
CDC or OGC. 

18.5.6.4.4 (U) Sixth Amendment Right to Counsel 

(U//FOUO) The Sixth Amendment Right to Counsel requires the government to advise and 
obtain a waiver of the Right to Counsel prior to interviewing the person to whom the right has 
attached. The Right to Counsel attaches upon indictment regardless of whether the indicted 
person realizes an indictment has been returned. The Right to Counsel also attaches upon the 
filing of information and at the time of an initial appearance on a Federal Complaint. The 
Right to Counsel is offense specific. When applicable, a warning regarding the Right to 
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Counsel and subsequent knowing and voluntary waiver must occur prior to an interview, 
regardless of whether the person is in custody. Providing a person with a Miranda warning 
and obtaining a waiver per the use of Form FD-395 will permit the interview of the person 
after the Right to Counsel has attached. The Sixth Amendment right to counsel does not 
prohibit the government from re-contacting the subject if the subject refuses initially to waive 
this right or otherwise has requested or obtained counsel following an Initial Appearance. 
However, further attempts to interview the subject may be prohibited if the subject invoked 



18.5.6.4.5 (U) Contact with Represented Persons 


(U//FOUO) CDC or OGC review is required before contact with represented persons in the 
absence of prior notice to counsel . Such contact may implicate legal restrictions and affect the 
admissibility of resulting evidence. Hence, if an individual is known to be represented by 
counsel in a particular matter, the CDC must follow applicable law and DOJ procedure when 
reviewing the request to contact the represented individual in the absence of prior notice to 
counsel. The SAC, CDC, or their designees, and the United States Attorney or his or her 
designees must consult periodically on applicable law and DOJ procedure relative to contact 
with represented persons. The field office may raise inconsistent application of: (i) state ethics 
rules; or (ii) rules for contacts with represented persons with the US AO and request that it 
consult with the DOJ Professional Responsibility Advisory Office. (AGG-Dom, Part V.B.l) 

18.5.6.4.6 (U) Members of the United States Congress and their Staffs 

(U//FOUO) Generally, FBI employees may accept information offered from Congressional 



18.5.6.4.7 (U) White House Personnel 


(U//FOUO) FBI employees may accept information offered by White House personnel just as 
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I I Additional guidance regarding contact with White House personnel may 

be found in the AG Memorandum captioned “Communications with White House and 
Congress” dated May 1 L 2009. (See DIQG Appendix D) Note : I I 


18 . 5 . 6 . 4.8 (U) Members of the News Media 

18 . 5 . 6 . 4 . 8.1 (U) Approval Requirements 

18.5.6.4.8JJ (U) General Requirements 

(U//FOUO) Attorney General approval must be obtained prior to conducting an interview 
of a member of the news media for any offense which the member of the news media is 
suspected of having committed in the course of, or arising out of, the coverage or 
investigation of a news story, or while engaged in the performance of his/her official 
duties as a member of the news media. Requests for this approval must be submitted with 
an EC to the AD of the operational FBIHQ division that is responsible for the 
investigative classification and the AD of the Office of Public Affairs (OPA). The 
requesting EC must be reviewed by the CDC and approved by the SAC after coordinating 
the request with the local USAO. The EC must contain the necessary facts and 
investigative justification for the interview consistent with the DOJ guidelines set forth in 
28 C.F.R. §50.10. 

18.5.6.4.8.L2 (U) Emergency Circumstances Requirements 

(U//FOUO) In emergency circumstances, an Agent may interview a news media 
representative concerning an offense which the member of the news media is suspected 
of having committed in the course of, or arising out of, the coverage or investigation of a 
news story, or while engaged in the performance of his/her official duties as a member of 
the news media without prior AG approval, if authorized by the SAC and the United 
States Attorney. Immediate notification of the interview, the emergency circumstances 
that justified proceeding without prior authorization and all the information that would 
have been provided if prior authorization had been sought shall be communicated 
immediately to the AD of the FBIHQ operational division, the AD of the OPA, and the 
General Counsel. The AD of the operational division is responsible for notifying the 
appropriate officials at DOJ as set forth in 28 C.F.R. 50.10. After these oral notifications 
have been made, the field office is responsible for providing written documentation to the 
FBIHQ operational division AD as soon as practicable, but not more than 24 hours after 
the interview. FBIHQ is responsible for providing appropriate written documentation to 
the DOJ approval authorities to whom oral notice was given. 
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18.5.6.4.8.2 (U) Use of Subterfuge 


(U//FOUO) To the extent operational needs allow, investigators must nneratp. nneniv 
consensuallv with members of the news medial 


b 7 E 


After consultation with the OPA and OGC, the AD of the operational division must 
decide whether to approve the request. If the request requires approval by DOJ (because 
the interview is related to an offense committed by the member of the news media during 
the course of news gathering) the AD of the operational division is responsible for 
submitting all requests for approval to the DOJ per 28 C.F.R. 50.10. 


(U//FOUO) FBIHQ operational division PGs may contain additional notice requirements. 


18.5.6.4.9 (U) During an Assessment -Requesting Information without Revealing FBI 

Affiliation or the True Purpose of a Request 


A) (U//FOUO) In the normal course of an interview, an FBI employee shou ld divulge the 
employee’s affiliation with the FBI and the true purpose of the interview! 


b; 


i (U//FOUOf~ 


C) 

' (U//FOUO)! 

i 

D) 


1 (U//FOUOf~ 



1) (U//FOUO)r 

1 1 

2) (U//FOUO)T 


3) (U//FOUOj~ 

1 1 

4) (U//FOUo£ 


b 7 E 


lb 7 F, 


fo7E 
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18.5.6.4.11.6 

(U) Example 6 

r 

ru//Fouol 1 


(U//FOUO)r 

1 




18.5.6.4.11.7 (U) Example 7 
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18.5.6.4.11.8 (U) Example 8 



1 8.5.6.4.12 (U//FOUO)Predicated Investigations - Requesting Information without 
Revealing FBI Apfilia tion or the True Purpose of a Request 



1 8.5. 6.4.13 (U) Interviews of Juveniles 


(U//FOUO) When determining whether to interview a juvenile (anyone under the age of 
eighteen) who does not fall within the provisions of the JDA above, e.g., when interviewing a 

18-31 

UNCLASSIFIED - FOR OFFICIAL USE ONLY , v"";. 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
§ 1 8 Domestic Investigations and Operations Guide 

juvenile as a witness or subject prior to arrest, and, if so, determining the scope and tactics 
that will be used, the FBI employee should consider the age and competency of the juvenile, 
whether the juvenile is emancipated, the juvenile’s relationship to the suspect(s), safety 
concerns, the gravity of the offense at issue, any alternative sources of evidence, the 
importance of the information or potential testimony to the investigation, and the juvenile’s 
degree of involvement, if any, with the offense. If the interview is custodial, compliance with 
the provisions of the Juvenile Delinquency Act (JDA) below is necessary. In determining 
whether a juvenile is in custody the test remains an objective test -was there a formal arrest or 
a deprivation of freedom of movement equivalent to an arrest. However, with respect to 
juveniles, if the juvenile’s age is known to the interviewer or is objectively apparent, the 
juvenile’s age is to be considered in the custody analysis. This is not to say that age is the 
determining or decisive factor in every case, but it recognizes that age is to be considered 
given a reasonable adult may view the circumstances surrounding the interview differently 
than a reasonable juvenile. If the juvenile is placed under arrest, the procedures listed in 

1 8.5.6.4.14 must be followed. If not under arrest, but based on the objective circumstances 
surrounding the interview, including the juvenile’s age, the juvenile is deemed to be in 
custody, the interviewer should advise the juvenile of their rights as set forth in the FD-395 
and cease the interview if the juvenile invokes a right. Parental consent for a juvenile 
interview should be obtained when feasible under the circumstances of the investigation. 

A) (U//FOUO) Special consideration should be given to child interviews and to interviews of 
juveniles who are of a tender age, maturity, or have a significant developmental disability. To 
the extent appropriate, agents should make use of local child protective services to aid in 
interviewing a child -- especially for an offense involving sexual exploitation of the child. The 
agents should consider seeking approval to video and/or audio record child interviews to 
address potential allegations that the child was manipulated and to have an unimpeachable 
record in case the child’s statement changes. 

B) U//FOUO) Federal statutes and the Attorney General Guidelines on Victim and Witness 
Assistance require federal investigators to utilize sensitive and developmentally appropriate 
practices designed to elicit the most accurate information from child victims and witnesses and 
to reduce unnecessary and additional trauma to these children. An interview should be 
appropriate for the age and developmental level of the child. It may be advisable in some 
instances for FBI employees to seek assistance with interviewing children - possibly by 
utilizing local child protective services - particularly, when the child is veiy young, 
developmentally disabled, or extremely traumatized. Interviews of child victims and 
witnesses, regardless of the type of crime, should be conducted by personnel properly trained 
in the techniques designed to best elicit accurate information from a child while minimizing 
additional trauma. 

18.5.6.4.14 (U) Interviews of Juveniles After Arrest 

(U//FOUO) Under the Juvenile Delinquency Act (JDA), a juvenile is anyone who commits a 
federal crime before his or her eighteenth birthday and who has not yet reached age twenty- 
one (21) before being charged. The provisions of the JDA, 18 U.S.C. § 5031 et seq.. apply 
upon arrest. 

A) (U//FOUO) Whenever a juvenile is arrested for a violation of federal law, he/she must be 
immediately advised of his/her legal rights and the United States Attorney must be notified. 
The juvenile’s parents, guardian or custodian must also be immediately notified of his/her 
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arrest as well as his/her rights and the nature of the alleged offense. After notification has been 
made, FBI employees must allow a parent, guardian, or custodian access to the juvenile if 
requested by the juvenile or by a parent, guardian or custodian of the juvenile. The juvenile 
must be promptly taken before a magistrate if a magistrate is available. If no magistrate is 
immediately available, the juvenile must be taken to a magistrate without undue delay. 

B) (U//FOUO) Whether a juvenile may be interviewed for a confession or admission of his own 
guilt between the time of his arrest for a federal offense and his initial appearance before the 
magistrate depends on the law of the circuit in which the arrest occurs. If the interrogation is 
not allowed under the law of the circuit, information volunteered by the arrested juvenile 
concerning his own guilt should be recorded in the FBI employee's notes for use in subsequent 
proceedings; clarifying questions may be asked as necessary to make certain the FBI 
employee correctly understands what the juvenile intends to say. The volunteered statement 
may be reduced to writing if such action does not involve any delay in the juvenile's 
appearance before the magistrate. Any questions concerning the law that applies in the 
particular circuit should be directed to the CDC. 

C) (U//FOUO) A juvenile may be questioned concerning the guilt of a third party if such 
questioning does not cause any delay in bringing him/her before the magistrate. 

D) (U//FOUO) These special requirements apply only after the arrest of a juvenile, as defined by 
federal law, for a federal offense. They do not apply when the juvenile is under arrest by state 
or local officers on a state or local charge but is suspected of having committed a federal 
offense. FBI employees may question a juvenile in custody on a non-federal charge about a 
federal offense for which he/she is a suspect. FBI employees are cautioned, however, that they 
may not collude or create the appearance of collusion with non-federal officers to delay an 
arrest on federal charges to circumvent the JDA requirements. 

E) (U//FOUO) A juvenile may waive his Fifth Amendment rights and consent to a post-arrest 
custodial interview if permitted by the law of the circuit. Whether a waiver is knowing and 
voluntary will be determined based on the totality of the circumstances surrounding the 
interview. Among the factors the court will likely consider are the juvenile’s age, experience, 
education, background, and intelligence, and whether he/she has the capacity to understand the 
warnings given, the nature of Fifth Amendment rights, and the consequences of waiving them. 

The presence and co-signature of a parent or guardian during the waiver of rights (FD-395) is 
not required for a voluntary waiver, although it is a factor to be considered and might help 
dispel any notion that the juvenile was coerced. The AUSA must approve a post-arrest 
custodial interview of a juvenile. 

b7E 

18.5.6A.15 (U) Documentation 

(U//FOUO) When it is anticipated that the results of an interview may become the subject of 
court te stimony, the in terview mu st be recorded on an FD-302 or l 1 

I I The FD-302 oi l "I must contain a record of statements made by the interviewee. 

Analysis or contextual comments regarding an interviewee’s statements should be 
documented in a companion EC or other appropriate format. If the interviewee characterizes 
an individual, group, or activity in a certain way, FBI records (i.e., 302s, ECs, LHMs) should 
reflect that the interviewee, not the FBI, is the source of the characterization. 

(U//FOUO) Certain types of written material developed during the course of an interview 
must be retained including; 
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A) (U//FOUO) Written statements signed by the witness. When possible, written statements 

should be taken in all investigations in which a confession or admission of guilt is obtained 
unless the confession is obtained during an electronically-recorded interview session. If a 
witness gives a signed statement, and then gives additional informatio n orally, both the signed 
statement and the oral information should be recorded on an FD-302 or | \ 

B) (U//FOUO) Written statements, unsigned by the witness, but approved or adopted in any 
manner by the witness. An example of such a written statement would be a written statement 
that the subject orally admits is true but will not sign; and 

C) (U//FOUO) Original notes of an interview when the results may become the subject of court 
testimony. Materials generated via email, text messages, or similar means during an online 
interview must be retained as original notes. Because some forms of synchronous 
communication tools, such as text messaging, have limited or no storage, print, or production 
capabilities, they should not be used for substantive communications with law enforcement 
colleagues or civilians who may become witnesses. If these tools are, nonetheless, used for 
substantive communications as part of an interview, the communications must be 
memorialized verbatim in an FD-302. 

D) (U//FOUO) If an FBI employee and an AUSA conduct an interview, and the AUSA asks or 
tel ls the FBI employee to refrain from recording the substance of the interview or taking notes, 
the FBI employee should decline to participate in the interview and should not be present 
when it takes place unless the interview is part of the trial preparation of the witness (or unless 
another law enforcement agent present is given the responsibility for taking notes and 
documenting the substance of the interview). FBI employees generally do not report the 
substance of trial preparation unless new material information or impeachment information is 
developed. FBI employees should consult with the trial AUSA to determine how to document 
any new information, including impeaching information, developed during the trial 
preparation interviews. 

18.5-6.4.16 (U) Electronic Recording of Interviews 

(U//FOUO) Special Agents must obtain ASAC approval (which may not be delegated) prior 
to recording interviews. The requirement to obtain approval is not intended to discourage 
recording or to indicate that the FBI disfavors recording. Indeed, there are many 
circumstances in which audio or video recording of an interview may be prudent. Approval to 
electronically record an interview must be documented on a FD-759. When recording a 
custodial interview, the recording should include an advice and waiver of Miranda rights, as 
well as a question and answer segment designed to demonstrate that the interviewee’s 
statements are voluntary and not the product of coercion. 

(U//FOUO) After completing the recorded interview, the agent must document the fact that 
the interview took place in an FD-302, noting the identity of the individual recorded and the 
details of the recording session (e.g., date, time, start and stop periods, reasons for stopping). 
FBI employees may include a summary of the recording in the FD-302 if doing so will aid 
them in the management of the investigation. Transcription of the recording is optional. 

(U//FOUO) Establishing within a field office reasonable standards for the types of 
investigations, crimes, circumstances, and subjects for which recording may be desirable will 
help maintain internal consistency. The following factors will assist the ASAC in determining 
whether to approve a request to record interview or interviews. These factors should not be 
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viewed as a checklist; they are not intended to limit the discretion of the approving official 
and are not intended to suggest that there is a presumption against recording. 

A) (U//FOUO) Whether the purpose of the interview is to gather evidence for prosecution, or 
intelligence for analysis, or both; 

B) (U//FOUO) If prosecution is anticipated, the type and seriousness of the crime, including, in 
particular, whether the crime has a mental element (such as knowledge or intent to defraud), 
proof of which would be considerably aided by the defendant's admissions in his own words; 

C) (U//FOUO) Whether the defendant's own words and appearance (in video recordings) would 
help rebut any doubt about the voluntariness of his confession raised by his age, mental state, 
educational level, or understanding of the English language; or is otherwise expected to be an 
issue at trial, such as to rebut an insanity defense; or may be of value to behavioral analysts; 

D) (U//FOUO) If investigators anticipate that the subject might be untruthful during an interview, 
whether a recording of the false statement would enhance the likelihood of charging and 
convicting the person for making a false statement; 

E) (U//FOUO) The sufficiency of other available evidence to prove the charge beyond a 
reasonable doubt; 

F) (U//FOUO) The preference of the USAO and the Federal District Court regarding recorded 
confessions; 

G) (U//FOUO) Local laws and practice-parti cularly in task force investigations where state 
prosecution is possible; 

H) (U//FOUO) Whether interviews with other subjects in the same or related investigations have 
been electronically recorded; and 

I) (U//FOUO) The potential to use the subject as a cooperating witness and the value of using his 
own words to elicit his cooperation. 

18.5.6.4.17 (U) Interviews Relating to Closed Files 

(U//FOUO) An interview initiated by an employee should only be conducted if it is within the 
scope of an open authorized Assessment or Predicated Investigation. On the other hand, there 
are situations in which an individual contacts the FBI to report information concerning a 
matter that has been closed or placed in a zero file classification, or is unrelated to any current 
or previous investigation. In these situations, an FBI employee may collect whatever 
information the person is willing to provide, except solely First Amendment information, and 
may document the results of the contact in an FD-71 /Guardian, or with an EC or FD-302. 
These documents may be uploaded in files that are relevant to an open Assessment or 
Predicated Investigation, a closed Assessment or Predicated Investigation, a zero 
classification file, or a control file (if no further investigative activity is required). 

18.5.6.4.18 (U) FBIHQ Operational Division Requirements 
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B) (U//FOUO) Other FB1HO Divisions : Each FBIHQ division may provide additional interview 
notice requirements in its PG. 

18.5.6.5 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 
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IRS. 7 (U) Investigative Method: Information Voluntarily Provided by 

Governmental or Priva te Entities 

(U) See AGG-Dom, Part II.A.4.g. 

18.5.7.1 (U) Scope 

(U//FOUO) An FBI employee may accept information voluntarily provided by federal, state, 
local, tribal, or foreign governmental or private entities and individuals. Voluntarily provided 
information includes, but is not limited to, oral as well as documentary and physical evidence 
such as a computer hard drive or other electronic media that contains information, paper 
documents containing information, or physical objects (e.g., handgun or narcotics). 

(U//FOUO) Nothing in this section prohibits asking for or accepting volunteered access to 
personal or real property. 

(U//FOUO) Note: Consent Searches are authorized in Assessments, as well as Predicated 
Investigations. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.7.2 (U) Application 

nj//Fouot I 


1&5.7.3 (U) Approval 

(U//FOUO) Supervisory approval is not required to accept voluntarily provided information. 
Personnel may not request nor knowingly accept information where disclosure would be 
prohibited by federal law. See, e.g., 18 U.S.C. § 2702 (prohibiting an entity providing 
electronic communications services from divulging certain communications and other 
records, except in certain circumstances). 

18.5.7.4 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 09-01-2011 BY UC 60322 LP/FJ/3Z 
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18.5.8 (U) Investigative Method: Physical Surveillance (not requiring a 

COURT ORDER) 

(U) See AGG-Dom, Part II.A.4.h - “Engage in observation or surveillance not requiring a court 
order.” Note: Consent Searches are authorized in Assessments. 

|iml 

18.5.8.1 (U) Scope 

(U//FOUO) Physical Surveillance Defined: Physical surveillance is the deliberate 
observation of persons, places, or events, on either a limited or continuous basis, in areas 
where there is no reasonable expectation of privacy. 

(U//FOUO]f~ 


rtl//FOUoI 


B) (U//FOUQ1 
CHU//FOUol 


D ) (U//FOUO)T 

(U//FOU O) Surveillance Enhancement Devi ce s; The use of mechanical devices operated b y 
the user (e.g., binoculars; hand-held cameras;] „ 

\ is authorized as part of physical 

surveillance provided that the dev ice is not used to collect information in which a person has a 
reasonable expectation of privacy! 



AHU//FQUQ)| 



\ 
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18.5.8.2 (U) Application 


18.5.8.3 (U) Approval 

(U//FOUO) Durin g an Asses sment, physical surveillance may be approved for a period of b7E 

time not to exceed ]" [ as explained further below. 

1 8. 5.8.3 . 1 (U//FOUO) STANDARDS FOR OPENING OR APPROVING PHYSICAL SURVEILLANCE 

During an Assessment 


(U//FOUO) During an Assessment, in addition to the standards contained in DIOG Sections 
5.5 and 5.8, the FBI employee and supervisor must consider the following: 

A) (U//FOUO) Whether the physical surveillance is rationally related to the articulated purpose 
and objective of the Assessment; 

B) (U//FOUO) Whether the physical surveillance is the least intrusive alternative for acquiring 
needed information; 


C) (U//FOUO) If the physical surveillance is for the purpose of determining a pattern of activity, 
whether there is a logical nexus between the purpose of the Assessment and the pattern of 
activity the employee is seeking to determine; and 


D) (U//FOUO) If being conducted in order to gather positive foreign intelligence, whether the 
surveillance is consistent with the requirement that the FBI employee operate openly and 
consensual ly with a USPER, to the extent practicable. 

18.5.8.3.2 (U//FOUO)\ kw? Assessments 
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1 

18.5.8.3.3 (V//FOUoJT 

1 1 

(U//FOUOlT 

Jn an FD-71, Guardian, an 

EC, or other appropriate form requesting Assistant Special Agent in Charge (ASAC) 
approval. 

(U//FOUO)r 

r |— ^ 

18.5.8.3.4 (l 

(u//fouoiT 

H 

Jinan FD-71, 

Uuardian, an EC, or other appropriate form requesting ASAC approval. 

18.5.8.3.4.1 (U//FOUO)Q 

(U//F0U0j~ 


18.5.8.3.4.L1 


(U//F0U0[ 



fc7E 


b?E 

b7E 


b7E 

b7E 

fc 7 E 

to 7 E 


■b 7 E 


b 7 F, 


b7E 
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18.5.8.3.4.3 (U//FOUO) Compliance and Monitoring 


(U//FOUO) A uthorization documents regarding the use of | 

Tnust be documented in the investigative ELSUR file. 


hlE 

hlE 
b 7 E 
b 7 E 
blZ 

hlZ 

hlE 
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18.5.8.4 (U) Other Physical Surveillance 

(U//FOUO) Physical surveilla nce conducted by employees, ot her than through use of the 
resources discussed above (i.e. l during a Predicated 

Investigation does not require supervisory approval. In addition) 


18.5.8.5 (U) Maintain a "Surveillance Log" during Physical Surveillance 

(U//FOUO) A surveillance log must generally be maintained for the purpose of documenting 
observations made during the period of physical surveillance. The log is a chronological 
narrative detailing the observations noted during the surveillance. A team member must be 
assigned to maintaining the surveillance log. At the end of the shift, each individual must 
initial on the surveillance log the notations of the activities he or she observed. Completed 
surveillance logs must be incorporated into the investigative file. Any original notes must be 
permanently retained in a 1 A envelope (FD-340a) in the investigative file. Surveillance logs 
must be concise and factual. When reporting locations, the surveillance log must be as 
specific as possible. Surveillance team members must avoid over-reporting and including 
unnecessary information; logs are subject to discovery in legal proceedings. 

18.5.8.6 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DICK} Section 14. 
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18.5.9 (U) Investigative Method: Grand J ury Subpoenas - for telephone or 

ELECTRONIC MAIL SUBSCRIBER IN FORMA TION ONLY (IN TYPE 1&2 

Assessments) 

(U) See AGG-Dom, Part ILA.4.L 

(U) See DIOG Section 18.6.5 for additional information on use of Federal Grand Jury (FGJ) 
subpoenas in Predicated Investigations. 

18.5.9.1 (U) Scope 

(U//FOUO) During a Type 1 & 2 Assessment, an FBI employee may request from an 
appropriate USAO the issuance of a FGJ subpoena for the limited purpose of obtaining 
subscriber information associated with a telephone number or e-mail address. A FGJ 
subpoena, under this provision, may not be requested for the purpose of collecting foreign 
intelligence. For more information regarding FGJ subpoenas, see DIOG Section 18.6.5. 

18.5.9.2 (U) Application 

I 1 b7E 


18.5.9.3 (U) Approval 

(U//FOUO) In Type 1 & 2 Assessments, telephone and electronic mail subscriber information 
may be requested through the use of an FGJ subpoena without supervisory approval. An agent 
requesting a grand jury subpoena during an Assessment must advise the AUSA, who will 
issue the subpoena, that the FBI is conducting an Assessment. The AUSA must determine 
whether there is sufficient connection between the Assessment and possible criminal conduct 
to warrant issuance of a FGJ subpoena. FGJ subpoenas may not be sought during a Type 3, 4, 

5, or 6 Assessment. 

18.5.9.4 (U) Electronic Communications Privacy Act (ECPA) (18 U.S.C. §§ 2701- 
2712) 

(U//FOUO) 18 U.S.C. § 2703(c)(2) states that “a provider of electronic communication 

service or remote computing service shall disclose to a governmental entity the: (i) name; (ii) 

address; (iii) local and long distance telephone connection records, or records of sessions, 

times and durations; (iv) length of service (including start date) and types of service utilized; b7E 

(v) telephone or instrument number or other subscriber number or identity, including any 

temporarily assigned network address; and (vi) means and source of payment for such service 

(including any credit card or bank account number), of a subscriber to or customer of such 

service when the governmental entity uses a Federal Grand Jury subnoenaJ I 

| See DIOG Sections 1 8.6.4 - 1 8.6.8. 
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18.5.9.5 (U) Use/Dissemination 

(U//FOUO) Because judicial districts vary as to whether subscriber records obtained through 
use of a FGJ subpoena must be handled pursuant to the FGJ secrecy rules as “matters before 
the grand jury,” subscriber records obtained pursuant to a FGJ subpoena should be protected 
as required by the judicial district (e.g., US AO) in which the FGJ subpoena is issued. In 
addition, in those judicial districts in which subscriber records obtained pursuant to a FGJ 
subpoena are considered to be “matters before the grand jury,” no documentation of the actual 
subscriber records should be made in the FD-7I or Guardian. Instead, a copy of the FGJ 
subpoena and the responsive subscriber records must be filed in a 1 A, IB, or 1C and uploaded 
to the GJ subfile. Due to developing law on this issue, employees should consult with the 
AUSA to determine whether such documents are considered to be FGJ materials and must 
handle them accordingly. The use or dissemination of information obtained by this method 
must comply with the AGG-Dom, DIOG Section 14, and the Federal Rules of Criminal 
Procedure (FRPC) Rule 6, 
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18.6 (U] Authorized Investigative Methods in Preliminary Investigations 


(U) See AGG-Dom, Part II.B and Part V.A.1-10. 

(U) In Preliminary Investigations the authorized methods include the following: 

A) (U) The investigative methods authorized for Assessments: 

1) (U) Public information. (See Section 18.5.1) 

2) (U) Records or information - FBI and DOJ. (See Section 18.5.2) 

3) (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. (See Section 18.5.3) 

4) (U) On-line services and resources. (See Section 18.5.4) 

5) (U) CHS use and recruitment. (See Section 18.5.5 ) 

6) (U) Interview or request information from the public or private entities. (See Section 

18.5.6) 

7) (U) Information voluntarily provided by governmental or private entities. (See Section 

18.5.7) 

8) (U) Physical Surveillance (not requiring a court order). (See Section 18.5.8) 

B) (U) Consensual monitoring of communications, including electronic communications. (See 
Section 18.6.1) 

C) (U) Intercepting the communications of a computer trespasser. (See Section 18,6.2 ) 

D) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (See Section 18.6.3) 

E) (U) Administrative subpoenas. (See Section 18.6.4) 

F) (U) Grand jury subpoenas. (See Section 18.6.5) 

G) (U) National Security Letters. (See Section 18.6.6) 

H) (U) FISA Order for business records. (See Section 18.6.7) 

I) (U) Stored wire and electronic communications and transactional records. (See Section 

18.6.8) 16 

J) (U) Pen registers and trap/trace devices. (See Section 18.6.9) 

K) (U) Mail covers. (See Section 18.6.10) 

L) (U) Polygraph examinations. (See Section 18.6.1 1 ) 

M) (U) Trash Covers (Searches that do not require a warrant or court order). (See Section 18.6.12) 

N) (U) Undercover operations. (See Section 18.6. 13) 


16 (U//FOUO) The use of Search Warrants to obtain this information in Preliminary Investigations is 
prohibited. (See D10G Section 18.6.8.4.2.3) 
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18.6.1 (U) Investigative Method: Consensual Monitoring of 

Communications, including Electronic Communications 

18.6.1.1 (U) Summary 

(U) Monitoring of wire, oral or electronic communications based on the consent of one party 
to the communication is referred to as consensual monitoring. The consent exception applies 
to the interception of wire, oral, and electronic communications. Consensual monitoring 
requires review by the CDC (Office of Origin - Field Office) or the OGC (Office of Origin - 
FBIHQ). (AGG-Dom, Part V.A.4) 

18.6. 1.2 (U) Application 



(U//FOUO) The law of the state or territory where the consenting party is located when 
making the recording will govern whether OLA approval is needed. 


(U//FOUO) See the OGC website for a list of all-party consent states. See also DIOG Section 
18.6.1.6, below. 

18.6.1.3 (U) Legal Authority 

A) (U) The Fourth Amendment to the United States Constitution and case law interpreting the 
same; 

B) (U) The Wiretap Statute, 1 8 U.S.C. § 25 1 1-2522 , prohibits the intentional interception and 
use of wire, voice, or electronic communications absent an exception; 

C) (U) The consensual monitoring exceptions, 18 U.S.C. § 251 l(2)(c) & (d), require one party to 
the communication to consent to monitoring; and 

D) (U) The Foreign Intelligence Surveillance Act of 1978 (FISA), 50 U.S.C. §§ 1801 et seq. 
provides that if a party to the communication has consented to monitoring, a FISA court order 
is not required. 

18.6.1.4 (U) Definition of Investigative Method 

(U) Generally, the Wiretap Statute (also referred to as Title III), 18 U.S.C. §§ 2510*2522, 
prohibits the intentional interception of wire, oral, or electronic communications unless one of 
several exceptions applies. One such exception is based on the consent of a party to the 
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communication. Two other statutory exceptions to the general prohibition include l) the 
warrant or court order exception, and 2) the computer trespasser exception. This section 
discusses the monitoring of communications under the consent exception. 

(U) Consensual monitoring is the monitoring of communications based on the consent of a 
party to the communication. (AGG-Dom, Part VILA.) For purposes of this policy, at least one 
of the parties to the communication must be located, or the interception of the consensual 
communication must occur, within the United States or the United States territories. The 
consensual monitoring of communications is subject to legal review by the CDC or OGC, as 
applicable. (AGG-Dom, Part V.A.4). Consensual monitoring includes the interception of the 
content of communications and typically fal Is into one of three general categories: 

A) (U) Wire communications . which include conventional telephone communications or other 
means of transmitting the human voice through cable, wire, radio frequency (RF), voice over 
Internet Protocol (VoIP), or other similar connections; 

B) (U) Oral communications . typically intercepted through the use of devices that monitor and 
record oral conversations (e.g., a body transmitter or recorder or a fixed location transmitter or 
recorder used during face-to-face communications in which a person would have a reasonable 
expectation of privacy but for the consent of the other party); and 

C) (U) Electronic communications . which include any transfer of signs, signals, writing, images, 
sounds, data, or intelligence by a wire, radio, electronic, or optical system or network (e.g., e- 
mail, instant message, chat sessions, text messaging, non-voice peer-to-peer communications), 
as that term is defined in 18 U.S.C. § 2510(12X14) and (17), which are intercepted and 
recorded at the time of transmission. The monitoring of electronic communications based on 
one party consent is sometimes referred to as "consensual computer monitoring." “Consensual 
computer monitoring” applies to “real time” electronic surveillance based on consent and does 
not include retrieving or obtaining records of communications that have been stored on the 
computer or elsewhere after the communication has occurred. 

(U) Note regarding electronic communications monitoring : Agents seeking to 
consensually monitor electronic communications (specifically, communications to, 
through, or from a computer) must consider whether the party who has consented is a 
party to all of the communications they want to monitor or whether some of the 
communications involve a computer trespasser, as defined by the computer trespasser 
exception. (See DIOG Section 18.6.2) The trespasser exception and the consensual 
monitoring of communications exceptions are related, but separate, exceptions to the 
Wiretap Statute. The owner, operator, and authorized users of a protected computer or 
computer network can consent to the monitoring of only those communications they send 
or receive (i.e., to which they are a party), which typically does not include a trespasser's 
communications. The trespasser exception allows the interception of the communications 
transmitted to or from the trespasser. 

(U) When applicable, the exceptions to the Wiretap Statute can be used together, 
permitting the interception of the communications of both authorized users and 
trespassers on the protected computer. This is particularly useful when it is difficult to 
discern the trespasser communications from other communications. If it is possible to 
obtain consent to monitor the communications of the authorized users, use of both the 
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consent and trespasser exceptions together can mitigate the risk of over or under 
col lection of the trespasser’s communications. 

18 . 6 . 1.5 (U) Standards and Approval Requirements for Consensual Monitoring 

18.6.1.5.1 (U) General Approval Requirements 

(U//FOUO) Except as provided below, an SSA may approve the consensual monitoring of 
communications if the information likely to be obtained is relevant to an ongoing Predicated 
Investigation. SSA approval, documented through the FD-759, is conditioned on the 
following criteria being met and documented on the FD-759 and other supporting 
documentation: 

18.6.1.5.1.1 (U) Reasons for Monitoring 

(U//FOUO) The synopsis must include sufficient factual information supporting the need 
for the monitoring. It must provide the relationship between the monitoring and the 
investigative purpose (e.g., obtain evidence of drug trafficking, public corruption, etc.). 

18.6.1.5.1.2 (U) Documented Consent of a Party to the Communication to 
be Monitored 

(U//FOUO) Consent must be obtained from one of the parties to be monitored, and the 
consent must be documented to the investigative ELSUR subfile. Having the consent of 
one of the parties provides an exception to the Title III statute. The requirement to obtain 
and document consent also applies to the monitoring of computer communications. See 
DIOG Section 18.6.1.7.1,1 for specific procedures. 

18.6.1.5.1.3 (U) Subject 

(U//FOUO) Agents conducting consensual monitoring must not intentionally intercept 
third-parties who are not of interest to the investigation except for unavoidable or 
inadvertent overhears. 

18.6.1.5.1.4 (U) Location of device 

(U//FOUO) Consensual monitoring can only be approved if appropriate safeguards are in 
place to ensure that the consenting party remains a party to the communication 
throughout the course of monitoring. For example, if a fixed-location monitoring device 
is being used, the consenting party must be admonished and agree to be present during 
the duration of the monitoring. If practicable, technical means must be used to activate 
monitoring only when the consenting party is present. 

18.6.1.5.1.5 (U) Notice of Consensual Monitoring to other Field Offices 

(U//FOUO) If an employee, CHS, or non-confidential third party is operationally tasked 
to conduct consensual monitoring outside the field office’s territory, the FBI employee 
requesting approval to conduct the monitoring must provide notice to the SSA who is 
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18.6.1.5*1.6 (U) Duration of Approval 


(U//FOUO) The request for approval must state the length of time needed for monitoring. 
Unless otherwise warranted, approval may be granted for the duration of the 
investigation, subject to a substantial change of circumstances. If one or more sensitive 
monitoring circumstances is present, DOJ may limit its approval to a shorter duration. 

See DIOG Section 18.6.1.6.3 below. 

18.6.1.5.1.7 (U) Legal Review 

(U//FOUO) Prior to the opening of consensual monitoring, the CDC or OGC must concur 
that, given the facts of the investigation, the consensual monitoring is legal. Although 
AUSA concurrence is no longer required for consensual monitoring, providing notice to 
the AUSA is encouraged. 

18.6.1.5.1.8 (U) Change of Monitoring Circumstances 

(U//FOUO) Whenever the monitoring circumstances change substantially, a new FD-759 
must be executed, and the CDC or OGC must be recontacted to obtain new concurrence. 
(AGG-Dom, Part V.A.4.) The following are examples of substantial changes in 
monitoring circumstances which require a new FD-759: a different consenting party, a 
change in the location of a fixed monitoring device, or the addition of a new computer 
system. If any of these or other monitoring circumstances substantially change, the FBI 
employee must immediately contact the CDC or OGC. 

18.6.1.5.1.9 (U) Joint Investigations 

(U//FOUO) In joint investigations, the policy and procedures for conducting any 
investigative method or investigative activity by employees or CHSs are usually 
governed by FBI policy. Similarly, employees from other agencies who are participating 
in a joint investigation with the FBI are generally governed by their agencies’ policies 
regarding approvals. If, however, the FBI has assumed supervision and oversight of 
another agency’s employee (e.g., a full time JTTF Task Force Officer), then FBI policy 
regarding investigative methods or investigative activity controls. Similarly, if another 
agency has assumed supervision and oversight of a FBI employee, unless otherwise 
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delineated by MOU, the other agency’s policy regarding investigative methods or 
investigative activity controls. 

(U//FOUO) Consensual monitoring conducted by a non-confidential party (e.g., witness, 
victim, etc.) will be controlled by the agency that is primarily responsible for the non- 
confidential party. In a joint investigation, the employees should reach an understanding 
as to which agency is responsible for the non-confidential party; that agency’s policies 
will govern approval and documentation requirements for consensual monitoring. 

18.6.1.6 (U) Consensual Monitoring Situations Requiring Additional Approval 

18.6.1.6.1 (U) Party Located Outside the United States 
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18,6.1. 6.2 (U) Consent of More than One Party Required for Consensual Monitoring 



(U//FOUO) The law of the state or territory where the monitoring will take place will govern 
whether OIA approval is needed. 


(U//FOUO) Consensual monitoring authority and OIA in all-party consent states with no law 
enforcement exception for FBI employees andl 

I and the authorization must he 


appropriately documented. As noted in DIOG Section 17.4 above, OIA authority for a CHS 
must be approved in conformity with the AGG-CHS and the FBI CHSPG. 




(U//FOUO) See the OGC website for a list of all-party consent states. See, also DIOG Section 
18.6.2, below. 



18,6.1.6.3 (U) Sensitive Monitoring Circumstance 

(U) Requests to monitor communications when a sensitive monitoring circumstance is 
involved must be approved by the DOJ Criminal Division, or, if the investigation concerns a 
threat to the national security or foreign intelligence collection, by the DOJ NSD. (AGG- 
Dom, Part V.A.4) A “sensitive monitoring circumstance” is defined in the AGG-Dom, Part 
VII.O, to include the following: 
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A) (U) Investigation of a member of Congress, a federal judge, a member of the Executive 
Branch at Executive Level IV or above, or a person who has served in such capacity within 
the previous two years (Executive Levels I through IV are defined in 5 U.S.C. §§ 5312-5315); 

B) (U) Investigation of the Governor, Lieutenant Governor, or Attorney General of any state or 
territory, or a judge or justice of the highest court of any state or territory, concerning an 
offense involving bribery, conflict of interest, or extortion related to the performance of 
official duties; 


C) (U) The Attorney General, the Deputy Attorney General, or an Assistant Attorney General has 
requested that the FBI obtain prior approval for the use of consensual monitoring in a specific 
investigation; 

D) (U) A party to the communication is in the custody of the Bureau of Prisons (BOP) or the 



1 0) (U//FOUO)[ | h 7 E 
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C) (U//FOUO) See the classified provisions in DIOG Appendix G for additional information 
regarding consensual monitoring. 


(U//FOUO) Procetfuft (qx Obtaining DOJ Aunravol Far a Sensitive Manitarina 
Circumstances 


(U//FOUO) Emergency requests involving Sensitive Monitarinp CirrumstnnrrA 
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18.6.1.7 (U) Duration of Approval 

(U//FOUoJ~ 



18.6.1.8 (U) Specific Procedures 

(U//FOUO) The following procedures apply when obtaining consent. 
18.6.1.8.1 (U) Documenting Consent to Monitor/Record 

(U//FOUO)! 1 
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(U//FOUOJ - 
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18 . 6 . 1 . 8 . 1.1 (U) Consensual Monitoring of Computers 


(U//FOUO)[ 


f Ithe CDC or OGC must review the document at issue to ensure that the implied 

consent is legally sufficient. 

18.6.1.8.2 (U) Documenting Approval 

-1 

( U // FOUO)r 

. 1 

J .0 ■' Hi 

1 

18.6.1.8,3 

1 

(U) Retention of Consbnsually Monitored Communica tions 


(U//FOUof 

1 

lb 7 E 



18.6.1.8.4 

(V) Multiple Communications 
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1 

18.6.1.8,5 

_l 

(V) Investigation Specific Approval 


( U // FOUO)P 

L 
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18.6.1.9 (U) Compliance and Monitoring 


(U//FOUO) Case agents and supervisors must regularly monitor the use of this method to 
ensure that the continued interception of communications is warranted and lawfully obtained 
by virtue of consent, express or implied, from a party to the communication. Such monitoring 
shal l include a review of the investigative file to ensure that consent and authorization forms 
are in the ELSUR subfile and properly completed by the requesting agent. ELSUR program 
personnel must review all submitted FD-759s and consent forms (FD-472 and FD-1071) to 
ensure proper approval is documented for the consensual monitoring of communications. 
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1 8. 6.2 (U) INVEST1GA TIVE METHOD: INTERCEPTING THE COMMUNICATIONS OF A 

Computer Trespasser 

18.6.2.1 (U) Summary 

(U) The wire or electronic communications of a computer trespasser to, from, or through a 
protected computer may be intercepted and collected during a Predicated Investigation. Use of 
this method requires SSA approval and review by the CDC (Office of Origin - Field Office) 
or the OGC (Office of Origin - FBIHQ). (AGG-Dom, Part V.A.4) 

18.6.2.2 (U) Application 

(U//FOUOl I b E 


18.6.2.3 (U) Legal Authority 

A) (U) The Fourth Amendment to the United States Constitution and case law interpreting the 
same; 

B) (U) The Wiretap Statute, 18 U.S.C. § 251 1, prohibits the intentional interception and use of 
wire, oral, or electronic communications absent an exception; 

C) (U) Computer Trespasser Exception, 1 8 U.S.C. § 251 1(2X1); and 

D) (U) The Foreign Intelligence Surveillance Act of 1978 (FISA), 50 U.S.C. §§ 1801 et seq., 
requires court authorization for “electronic surveillance.” FISA specifically provides, 
however, that the acquisition of computer trespasser communications that would be 
permissible under 18 U.S.C. § 25 1 1(2X0 are not subject to the FISA court order requirement 
for electronic surveillance of wire communication under section 101(f)(2) of FISA. 50 U.S.C. 

§ 1801(f)(2). 

18.6.2.4 (U) Definition of the Communications of a Computer Trespasser 

(U) Generally, the Wiretap Statute (also referred to as Title III), 18 U.S.C. §§ 2510-2522, 
prohibits the intentional interception of wire, oral, or electronic communications unless one of 
several exceptions applies. One such exception is the interception of a computer trespasser’s 
wire or electronic communications to, through or from a protected computer based on the 
authorization of the owner or operator of that computer. Another statutory exception is based 
on the consent of a party to the communication. This section relates specifically to the 
computer trespasser exception; the policy on consensual recording of computer 
communications can be found at DIOG Section 1 8.6.1. 


(U) The computer trespasser exception to the Wiretap Statute, 18 U.S.C. § 25 1 l(2)(i), permits 
a person acting under color of law to intercept the wire or electronic communications of a 
computer trespasser that are transmitted to, through, or from a protected computer when the 
owner or operator of that computer authorizes the interception. The use of this method does 
not include retrieving or obtaining records of communications that have been stored on the 
computer or elsewhere after the communication has occurred. 
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(U) The statute requires: 

A) (U) The owner or operator of the protected computer to authorize the interception of the 
trespasser’s communications on the protected computer, 

B) (U) The person acting under color of law to be engaged in a lawful investigation; 

C) (U) The person acting under color of law to have reasonable grounds to believe that the 
contents of the trespasser’s communications will be relevant to the investigation; and 

D) (U) The interception is limited to the communications transmitted to or from the trespasser. 

(U) The case agent is responsible for documenting the basis for the conclusion that the person 
who provided authorization to intercept the trespasser’s communications is either the owner 
or operator of the protected computer. The “owner or operator” must have sufficient authority 
over the protected computer/computer network system to authorize access across the entire 
system. This could be a corporate officer, CIO, or system administrator, if the system 
administrator has authority across the entire system. In any instance in which the 
identification of the owner or operator is not plainly evident, the case agent must seek the 
assistance of the CDC or the OGC to identify the proper owner or operator. 

(U) A "protected computer," defined in 18 U.S.C. § 1030(e), has been generally interpreted to 
be any computer or computer network device connected to the Internet, although it also 
includes most computers used by a financial institution or the United States Government 
regardless of whether the computer is connected to the Internet. 

(U) A “computer trespasser” is a person who accesses a protected computer without 
authorization and thus has no reasonable expectation of privacy in any communication 
transmitted to, from, or through the protected computer. The definition of computer trespasser 
does not include a person known by the owner or operator to have exceeded their authority or 
to have an existing contractual relationship with the owner or operator for access to all or part 
of the computer. (18 U.S.C. § 2510(21)) 

(U) The trespasser exception and the consensual monitoring of communications exception are 
related, but separate, exceptions to the Wiretap Statute. The owner, operator, and authorized 
users of a protected computer can consent to the monitoring of only those communications 
they send or receive (i.e., communications to which they are a party), which do not include a 
trespasser's communications. (See DIOG Section 18.6.1) In comparison, under the trespasser 
exception, the owner or operator may only authorize the interception of the communications 
of a trespasser transmitted to, through or from the protected computer. 

(U) When applicable, the computer trespasser and consensual monitoring of communications 
exceptions to the Wiretap Statute can be used together, permitting the interception of 
communications of both authorized users and trespassers on the protected computer. This is 
particularly useful when it is difficult to discern the trespasser communications from other 
communications. If it is possible to obtain consent to monitor the communications of the 
authorized users, using the consent and trespasser exceptions together can mitigate the risk of 
over or under collection of the trespasser's communications. See DIOG Section 18.6.1 for the 
policy regarding consensual monitoring of computer communications. 
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18.6.2.5 (U//FOUO) Use and Approval Requirements for Intercepting the 
Communications of a Computer Trespasser 

18 . 6 . 2 . 5.1 (U) General Approval Requirements 

(U//FOUO) An SSA may approve the use of the computer trespasser exception, subject to 
CDC or OGC review. Approval is conditioned on the following criteria being met and 
documented on the FD-759 and through other supporting documentation in the investigative 
file: 

18.6.2.5.1.1 (U) Reasons for the Interception 

(U//FOUO) The synopsis portion of the FD-759 must include sufficient facts to support 
the need for the interception and to explain how the contents of the trespasser's 
communications will be relevant to the investigative purpose. 

18.6.2.5.1.2 (U) Owner or Operator Authorization 

(U//FOUO) The authorization of the owner or operator of the protected computer (who 
may be the system administrator, as stated above) to a person acting under color of law to 
intercept the trespasser communications on the protected computer system or network 
must be documented using the FD-1070, Authorization to Intercept the Communications 
of a Computer Trespasser. The steps the case agent takes to ensure that the person 
providing the authorization is the actual or appropriate owner or operator of the protected 
computer must be documented in the investigative file. See 18.6.2.6 below for specific 
procedures. 

18.6.2.5.1 3 (U) Acquiring only Trespasser Communications 

(U//FOUO) When intercepting communications under the computer trespasser exception 
alone (i.e., not in conjunction with consensual monitoring of electronic communications), 
the collection must not intentionally acquire communications other than those to or from 
the trespasser. This can often be technically complicated to accomplish depending on the 
use and configuration of the protected computer and the sophistication of the trespasser. 
The steps to be taken to identify trespasser communications and to isolate such 
communications from those of authorized users must be considered by the approving and 
reviewing officials and documented in the investigative file. See DIOG Section 18.6.2.6 
below for specific procedures. 

18.6.2.5.1.4 (U) Owner or Operator Collection 

(U//FOUO) The interception of trespasser communications may be conducted by the FBI 
or by the owner or operator of the protected computer at the FBFs request. In either 
instance, the interception is being conducted under color of law. If the collection is not 
being conducted by the FBI, the case agent must document that he or she has informed 
the person conducting the interception that it must be accomplished in conformity with 
the statute. 
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18.6.2.5.1.5 (U) Location of Intercept 

(U//FOUO) If the intercept or collection of the trespasser communications will occur 
outside of the field office of the approving official, the SAC or ASAC of the field office 
within which the interception will occur must be notified, and the notification must be 
documented in the investigative file. 

18.6.2.5.1.6 (U) Duration 

(U//FOUO) The request for approval (FD-759) must state the length of time needed for 
the interception. Unless otherwise warranted, approval may be granted for the duration of 
the investigation, subject to a substantial change of circumstances, as described in DIOG 
Section 18.6.2.6, below. 

18.6.2.5.1.7 (U) Legal Review 

(U//FOUO) Prior to the opening of the interception, the CDC or OGC must concur that, 
given the facts of the investigation, the interception appears to be lawful under the 
computer trespasser exception. Whenever the factors surrounding the use of the approved 
technique change substantially, a new FD-759 must be executed. The newly executed 
FD-759 must include refreshed concurrence of the CDC or OGC. (AGG-Dom, Part 
V.A.4.) The following are examples of substantial changes in the circumstances of the 
interception that require a new FD-759: a change in owner or operator, a change in the 
method of collection, or the change or addition of a protected computer system. On the 
other hand, technical changes in the collection system for the purpose of improving or 
refining the interception are usually not substantial changes to the circumstances of the 
interception. 

18.6.2.5.1.8 (U) Joint Investigations 

(U//FOUO) In joint investigations, if the FBI is the lead investigating agency, FBI 
policies and guidance regarding the interception of computer trespasser communications 
must be followed. If the FBI is not the lead investigating agency, the policies of the lead 
investigating agency must be followed and documented to the appropriate FBI 
investigative file. 

18.6.2.5.1.9 (U) Extraterritorial Considerations 

HI//FOI ml 1 
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18.6.2.6 (U) Duration of Approval for Intercepting the Communications of a 
Computer Trespasser 

(U//FOUO) The interception and collection of computer trespasser communications under the 
computer trespasser exception may be approved for a specified length of time or for the 
duration of the particular investigation. 

18.6.2.7 (U) Specific Procedures for Intercepting the Communications of a 
Computer Trespasser 

(U//FOUO) The following procedures apply when obtaining authorization. 

18.6.2.7.1 (U) Documenting Authorization to Intercept 

(U//FOUO) Whenever possible, written authorization must be obtained from the owner or 
operator of the protected computer and documented on an FD-1070, Authorization to 
Intercept the Communications of a Computer Trespasser. 

(U//FOUO) If the authorization from the owner or operator is provided orally, at least one FBI 
agent and another law enforcement or intelligence officer should witness the authorization, 
and the authorization must be memorialized in an FD-302. The fact that the authorizing party 
has declined or was unable to give written authorization must also be recorded on the FD- 
1070, Authorization to Intercept the Communications of a Computer Trespasser form. This 
form should then be executed in all respects with the exception of the authorizing party's 
signature. 

(U//FOUO) The case agent must document to the file (i.e., FD-302 or EC) the facts that 
establish that the person providing the authorization is a proper party to provide authorization 
for the anticipated interception. 

(U//FOUO) If the case agent is seeking approval for the FBI to engage in both consensual 



18.6.2. 7.2 (U) Acquiring Only the Trespasser Communications 


(U//FOUO) The computer trespasser exception permits the FBI to intercept only trespasser 
communications. Prior to seeking approval to intercept computer trespasser communications, 
the case agent must coordinate the use of the method with the Field Office Technical Advisor 
by submission of an Electronic Technical Request (ETR). On receipt of the ETR, the 
Technical Advisor must ensure that the technical equipment and expertise necessary to 
lawfully implement the interception are timely provided following approval to use this 
investigative method. 

(U//FOUO) Many of the technical challenges and risks associated with accurately isolating 
the trespasser communications can be mitigated by also obtaining consent to monitor the 
computer or a court order. The possibility of using the authority to intercept trespasser 
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communications in conjunction with consent should be raised at the time of the ETR 
submission or as soon thereafter as the case agent determines that the authorized users of the 
protected computer will consent to FBI monitoring. 

(U//FOUO) When intercepting trespasser communications, the case agent must prepare an 
FD-302 or EC detailing the steps taken to identify trespasser communications and to isolate 
such communications from those of authorized users. For example: "reviewed system logs 
provided by the system administrator and identified a trespasser accessing the system at the 
following dates and times via BP address xxx or port xxx." Additionally, any subsequent 
review or revision of the steps needed to identify and isolate the trespasser's communications 
must also be documented to the investigative file by an EC or FD-302, as appropriate. 

18.6.2.7.3 (U) Reviewing the Accuracy of the Interception 

(U//FOUO) At the opening of interception and collection of computer trespasser 
communications, the Technical Advisor or designated technically trained agent (TTA) 
coordinating the implementation of the interception and collection device shall ensure that 
appropriate collection parameters are implemented as required by OTD policy and 
procedures. 

(U//FOUO) The case agent shall ensure a timely initial review of the collected information to 
verify that the interception and collection are limited to communications authorized for 
interception and collection under the trespass authority or other lawful exception. Following 
this initial review, the case agent shall ensure that a similar review and evaluation is repeated 
at appropriate intervals throughout the duration of the interception to ensure that the 
interception and collection remain within the scope of the trespasser or other lawful 
exceptions. 

(U//FOUO) Any FBI employee who identifies interception and collection of communications 
that may be outside the scope of the trespasser or other lawful exception shall immediately 
notify the case agent and the operational SSA of the possible unauthorized interception and 
collection of communications. Upon the determination that communications have been 
unlawfully intercepted or collected, the interceptions and collection must be halted 
immediately. The case agent must consult with a TTA to determine whether collection may be 
resumed in a manner that assures further unlawful collections will not occur. If the SSA 
determines that unlawful collection can be reliably prevented, that determination must be 
documented to the file before lawful interceptions and collection may resume. 

(U//FOUO) The content of communications determined to have been unlawfully collected 
cannot be used in any manner and shall be removed promptly from all FBI systems and 
destroyed. A memorandum documenting the removal and destruction shall be filed in the 
main investigation file and ELSUR Sub File. 

18.6.2. 7.4 (U) Reviewing the Relevancy of the Interception 

(U//FOUO) The trespasser exception requires the FBI to have a reasonable belief that the 
contents of the trespasser’s communications will be relevant to the investigation. Following 
opening of the interception and collection of the trespasser communication, the case agent 
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must ensure that the collected communications are reviewed, at appropriate intervals 
throughout the duration of the interception, to determine whether the interception is and 
continues to be relevant to the authorized investigation. 

18.6.2. 7.5 (U) Dura tion of Approval 

(U//FOUO) Authorization to intercept trespasser communications remains valid until such 
time as the authorizing party, orally or in writing, revokes the authorization or on the 
termination date of the authorization, whichever comes first. 

18.6.2. 7.6 (U) ELSUR Requirements 

(U//FOUO) The information obtained from the collection must be retained in conformity with 
the ELSUR Policies (See ELSUR Guide. Electronic Surveillance Manual, and Electronic 
Surveillance Issues located in the OGC Main Law Library) or other applicable policies. 

18.6.2. 7. 7 (U) Multiple Communications 

(U//FOUO) In investigations in which various modes of communication may be intercepted 
(e.g., telephonic, non-telephonic, electronic communications, etc., or the use of consensual 
computer monitoring in conjunction with the interception of trespasser communications), one 
FD-759 may be used to document approval, provided that each mode of communication to be 
monitored is being used in the same investigative file and all facts required on the FD-759 are 
the same. If the material facts on the FD-759 vary (e.g., different periods of authority, etc.), 
separate FD-759s must be executed. 

18.6.2. 7.8 (U) Investigation Specific Approval 

(U//FOUO) Approval for intercepting a computer trespasser's communications is 
investigation specific and is not transferable to any other investigation, unless the 
investigative file under which the authority was granted is consolidated or reclassified. 
Investigation specific approval must be obtained for any spin-off investigation(s) that arises 
out of the original investigation. 

18.6.2.8 (U) Compliance and Monitoring 

(U//FOUO) Case agents must regularly monitor the use of this method to ensure that the 
continued interception of trespasser communications is warranted and being lawfully 
conducted. Such monitoring shall include a review of the investigative file to ensure that 
consent and authorization forms have been properly executed and filed. ELSUR program 
personnel must review all submitted FD-759s and FD-1070 (Authorization to Intercept the 
Communications of a Computer Trespasser form) to ensure proper approval has been 
documented for the interception of computer trespasser communications. 
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18.6.3 (U) Investigative Method: Closed-Circuit Television/Video 

Surveillance, Direction Finders, and other Monitoring Devices 


18.6.3.1 (U) Summary 



18.6.3.2 (U) Application 

UJ//FOUQ1 

prohibited by AGG-Dom, Part III.B.2-3 J 

18.6.3.3 (U) Legal Authority 

A) (U) AGG-Dom, Part V 

B) (U) Tracking devices use (1 8 U.S.C. § 2510(12XC) 

C) (U) Rule 41 Federal Rules of Criminal Procedure 

D) (U) Fourth Amendment to the United States Constitution 

18.6.3.4 (U) Definition of Investigative Method 

A) (U//FOUO) Closed Circuit Television/Video Surveillance (CCTV/Video Surveillance) : a 
fixed-location video camera/device that is typically concealed from view or that is placed on 
or operated by a consenting party. 

E O (U//FOUO) E lectronic Tracking Devices J~ | 


(Electronic tracking devices are specifically excluded 
from Title III requirements ( 1 8 U.S.C. § 2510( 12XQ). In circumstances where a court order is 
required (pursuant to FRCP. Rule 41(e)(2)(C), a judge or magistrate may authorize the use of 
an electronic tracking device within the jurisdiction of the court and outside that jurisdiction, if 
the device is installed in that jurisdiction. (FRCP Rule 41(b)(4); 18 U.S.C. § 3 1 17) 
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18.6.3.5 (U//FOUO) Standards for Use and Approval Requirements for 
Investigative Method 

(U//FOUO) When a video camera is physical ly operated as a hand-held video and is used in 
an area in which no one has a reasonable expectation of privacy, its use is equivalent to using 
a still camera and does not require CDC review or SSA approval. 

(U//FOUO) Except for a hand-held video as described above, CDC or OGC review and SSA 
approval is required for the use of CCTV/Video Surveillance, tracking devices, and other 
monitoring devices. CDC review and SSA approval must be documented using the FD-759. 
SSA approval may be granted if the following criteria have been met: 

A) (U//FOUO) Legal review and concurrence from the CDC or OGC that a court order is not 
required for installation or use of the device because there has been lawful consent, no 
reasonable expectation of privacy exists, or no physical trespass is necessary to install the 
device. Whenever circumstances change in either installation or monitoring, a new legal 
review must be obtained to determine whether a separate authorization is necessary; 

B) (U//FOUO) Use of the method is reasonably likely to achieve investigative objectives; 
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18.6.3.8 (U) CCTV/Video Surveillance where there is a Reasonable Expectation of 

Privacy in the area to be viewed or for the installation of the equipment. 


(U//FOUO) A warrant/court order is required for the use of CCTV/Video Surveillance when a 
reasonable expectation of privacy exists in either the area to be viewed or the location where 
the equipment will be installed, unless the installation and monitoring is being conducted 
pursuant to consent. 

A) (U//FOUO) Criminal Investigations : When there is a reasonable expectation of privacy in the 
area to be viewed and no consenting party, prior DOJ/OEO approval is required before 
seeking a warrant/order. When there is a reasonable expectation of privacy only in the location 
where the CCTV/Video Surveillance equipment will be installed, but not in the area to be 
viewed, prior DOJ/OEO authorization is not required to seek a warrant/order for the 
installation. In an emergency situation where CCTV usage is desired and a warrant/court order 
would be required, but cannot be obtained within the time required, an AUSA must be 
contacted to seek DOJ/OEO’s guidance on how to proceed. 

B) (U//FOUO) National Security Investigations : The use of CCTV/Video Surveillance in 
national security investigations under the Foreign Intelligence Surveillance Act of 1978 
(FISA) requires the filing of an appropriate FISA court order because the use of CCTV/Video 
Surveillance falls within the definition of “electronic surveillance” under FISA. See DIOG 
Section 18.7.3. 

C) (U//FOUO) Where a warrant is required and the request is included with a Title HI or is a 
FISA request : Where the CCTV/video surveillance request is made pursuant to FISA or in 
conjunction with a Title III request, the required supervisory approvals and CDC or OGC 
review will take place as part of the larger FISA or Title III review and approval process. No 
additional reviews or approvals for the CCTV/video surveillance are required. 

D) (U//FOUO) Where a warrant is required and the request is NOT coupled with a Title III 
request or made pursuant to FISA : As the FD-759 is not used when a court order is needed, 
the required SSA approval and CDC or OGC review must be documented in an EC. A copy 
of the approving EC must be maintained in the field office ELSUR Subfile and a copy in the 
field office CCTV/Video Surveillance control file. 

(U//FOUO) For additional information regarding the use of CCTV/Video Surveil lance when a 
reasonable expectation of privacy exists, see the Video and Physical Surveillance Programs 
Policy Implementation Guide. 

18.6.3.9 (U) Compliance and Monitoring 

(U//FOUO) Authorization documents regardin g the use of the CCTV/Video Surveillance and ]b? 

| must be documented in the investigative 
ELSUR file and will be available for compliance and monitoring review. 
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18.6 .4 (U) Investigative Method: Administrative Subpoenas (compulsory 

process) 


18.6.4.1 (U) Overview of Compulsory Process 

ojh fouoI 



18.6.4.3 (U) Administrative Subpoenas 

1 8 . 6.4.3 . 1 (U) Summary 


(U) The Attorney General has the authority to issue administrative subpoenas pursuant to two 
provisions of the United States Code, 21 U.S.C. § 876 and 18 U.S.C. § 3486. The FBI has no 
inherent authority to issue administrative subpoenas but has delegated authority from the 
Attorney General to do so. The use of administrative subpoenas is limited to three categories 
of investigations — drug program investigations, child sexual exploitation and abuse 
investigations, and health care fraud investigations — and may not be used for any other 
purpose. The deligated authority varies depending on the federal violation being investigated. 
The type of information that can be obtained using an administrative subpoena is also limited 
by law and by policy of the Attorney General. 

fe 

(U//FOUO) Within the FBI, the authority to issue administrative subpoenas is limited to 
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18,6.43.2 (U) Legal Authority and Delegation 


18.6.4.3.2.1 (U) Investigations involving the sale, transfer, manufacture 

or importation of unlawful drugs 

(U) Authority: 21 U.S.C. § 876 and DOJ Regulation at 28 C.F.R. App to Pt. 0, Subpt. R § 
4. 

(U) May be issued to : Any individual or business holding records relevant to the drug 
investigation. 

(U) Records to be obtained : Any records relevant or material to the investigation. 

(U//FOUO) Delegated authority to issue : By DOJ regulation, the Attorney General’s 
delegation includes SACs, ASACs, SSRAs and “those FBI Special Agent Squad 
Supervisors who have management responsibilities over Organized Crime/Drug Program 
investigations.” 


U//FOUOI Multi-offense investigations: 



18.6.4.3.2.2 (U) Investigations involving the sexual exploitation or abuse 

of children 


(U) Authority; 18 U.S.C. § 3486(a) and Attorney General Order 3220-2010. 

(U) May be issued to: A “provider of an electronic communication service” or a “remote 
computer service” (both terms defined below in DIOG Section 1 8.6.4. 1.4.2.b) and only 
for the production of basic subscriber or customer information. The subpoena may 
require production as soon as possible but in no event less than 24 hours after service of 
the subpoena. 
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(U//FOUO) Violations to which this authority applies: These administrative subpoenas 
may only be issued in investigations that involve a violation of 18 U.S.C. §§ 1201, 1591, 
2241(c), 2242, 2243, 2251, 2251 A, 2252, 2252A, 2260, 2421, 2422, or 2423 in which the 
victim is Jess than 18 years old. Under the Attorney General's delegation, an 
administrative subpoena in these investigations may be issued only to “providers of 
electronic communication services” or to ‘"remote computing services” to obtain the 
information listed above. These administrative subpoenas may not be issued to any other 

person or entity or to obtain an v other information, including the content of . b 

communications] L_ 


18.6.4.3:2.3 (U) Investigations involving Federal Health Care Fraud 

Offenses 

(U) Authority: 18 U.S.C. § 3486(a) 

(U) Records to be obtained : Records relevant to an investigation relating to a “federal 
health care offense.” Federal health care offense is defined in 18 U.S.C. § 24. 

(U) May be issued to : Any public or private entity or individual with records relevant to 
the federal health care offense. (These are referred to in guidance issued by the Attorney 
General as “investigative demands.”) 

(U//FOUO) Delegated authority to issue : The Attorney General has not delegated 
signature authority to the FBI. AG authority is delegated only to personnel within DOJ’s 
Criminal Division and to United States Attorneys, who may redelegate the authority to 
AUSAs. FBI employees must request an AUSA to issue administrative subpoenas in 
health care fraud investigations. 
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(U) Limitations : The Right to Financial Privacy Act (RFPA) limitations described in 
paragraph D of this section apply. The provisions in ECPA govern, as discussed in 
paragraph D of this section, if the request for records is addressed to a “provider of 
electronic communication service” or a “remote computing service.” The subpoena may 
not require the production of records at a place more than 500 miles from the place the 
subpoena is served. ^ , 

»nl I— i 


(U) Restriction on use of health care information asainst the individual : Pursuant to 1 8 
U.S.C. § 3486, health information about an individual acquired through an authorized 
investigative demand may not be used in, or disclosed to any person for use in, any 
administrative, civil, or criminal action against that individual unless the action or 
investigation arises from and is directly related to receipt of health care, payment for 
health care, or a fraudulent claim related to health care. 

18.6.4.3.3 (U) Approval Requirements 


18 * 6 . 4 . 3 . 3.1 (U) Required form 


A)(U T 
form[ 


^ ust be prepared and issued using the electronic^ 
r a cnrpregnr plAr'fronrr frim aiithnrWoH f or thlS 


The online form is designed to ensure an 


UC£ 

anL 


f tnonzea tor tms purpose, 
is: (1) issued only in 


investigations where its use is permitted; (2) used to demand information that can be obtained 
within the app licable leg al and policy limitati ons; and (3) signed by an indiv idual with proper 
authority. The | p iust be uploaded intn | Tin the relevant 

investigative file from which it is issued . An electronic copy of l t will 

automatically be saved i n the I [data base when it is uploaded. 

- I 


— Jr emain 

temporarily available but th eir use is restricted t o emergency situations when the l | is 


not available. Whenever th j lis used, the egal requireme nts and the 

delegation authorities discussed above apply. I issued using an I 

or successor form must be unload ed into automated case support (ACS). Additionally, 
whenever th gl ■■ I s used, as soon as possible the FBI employee must also 

complete a n|_ |usi np the iden tical information. The employee should not serve the 

ben 


|USl 

generated by th 


but must attach it to the file copy of the£ 


C) (U) Ar | l addressed to an electronic communication service 

provider contai ns an attachment explaining the meaning of various terms used in the riemami 




'a DOJ 

lissued by the FBI or proposed by the FBI for issuance by 


attorney without approval from OGC or the CDC. That approval must be documented to the 


file. 
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18 . 6 . 4 . 3 . 3.2 (U) Approval authority 

(U//FOUO) Use of an administrative subpoena requires SSA approval. The subpoena 
may be issued by the SSA if that SSA is among those with delegated authority to do so. 
See DIOG Sections 18.6.4.2,2.1 - 18.6.4.2.2.3 above) Otherwise, the subpoena must be 
forwarded to an individual with the proper delegated authority. Further review and 
approval may be required depending on the delegation. Review by the CDC is 
appropriate if legal questions arise in preparing and issuing the subpoena. 


ru//FOUol 


h 


18.6A.3A (U) Limitationson Use of Administrative Subpoenas 


18 . 6 . 4 . 3 . 4.1 (U) Financial Privacy Limitations 

18.6A.3A.L1 (U) Obtaining records from a financial institution 

(U//FOUO) “Financial records” are those records that pertain to a customer’s relationship 
with a financial institution. The term “financial institution” is broadly defined as a bank, 
savings bank, card issuer, industrial loan company, trust company, savings association, 
building and loan or homestead association, credit union, or consumer finance institution, 
located in any state, territory, or the District of Columbia. See 12 U.S.C. § 3401 . {Note : 
The scope of the RFPA’s definition of financial institution for this purpose, which limits 
the restrictions the RFPA places on federal law enforcement in using an administrative 
subpoena, is narrower than the definition of financial institution that is used in connection 
with NSLs. For that purpose, the RFPA refers to the broader definition found in the Bank 
Secrecy Act (BSA). Among the entities included in the BSA definition are money 
transmitting businesses, car dealers, travel agencies, and persons involved in real estate 
closings. See 12 U.S.C. § 3414(d) and 31 U.S.C. § 5312 (a)(2) and (c)(1).) When seeking 
financial records from a financial institution, the FBI must send a certificate of 
compliance required by 12 U.S.C. § 3403 to the financial institution. The certificate must 
indicate, among other things, that notice has been provided by the FBI to the individual 
customer whose financial records are to be obtained. The content of the notice is set out 
in 12 U.S.C. § 3405. A court order may be obtained that allows for delayed notice 
pursuant to 12 U.S.C. § 3409. Notice is not required if the administrative subpoena is 
issued to obtain the financial records of a corporation or for records not pertaining to a 
customer. Notice is also not required if the administrative subpoena seeks only basic 
account information, defined as name, address, type of account, and account number. See 
12 U.S.C. § 3413(g). 
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18.6.4.3.4.1.2 (U) Obtaining records from a Credit Bureau 

(U//FOUO) A credit bureau or consumer reporting agency may only provide name, 
address, former addresses, place of employment and former place of employment in 
response to an administrative subpoena. See 15 U.S.C. § 168 If. A credit bureau or 
consumer reporting agency may not release financial information in a credit report or 
consumer report, or the names and locations of financial institutions at which the 
consumer has accounts pursuant to an administrative subpoena. A court order, a grand 
jury subpoena, or, in an appropriate investigation, a national security letter may be used 
to obtain this information. 15 U.S.C. § 1681b. Notice of disclosure will be provided by 
the credit bureau or consumer reporting agency to the consumer if the consumer requests 
this information. 

18.6.4.3.4.2 (U) Electronic Communication Privacy Act 

(U//FOUO) The ability to gather subscriber information and the content of electronic 
communications using an administrative subpoena is governed by ECPA. In 
investigations involving the sexual exploitation or abuse of children, only basic 
subscriber or customer information may be obtained with an administrative subpoena 
under the terras of the Attorney General’s delegation, as described above. No content 
information may be obtained. In drug and health care fraud investigations, an 
administrative subpoena may be used to obtain basic subscriber or customer information 
and certain stored communications, under limited circumstances, from entities that 
provide electronic communication services to the public. 

18.6.4.3.4.2.1 (U) Scope 

(U//FOUO) ECPA applies to two types of entities that provide electronic 
communications to the public. They are: 

A) “Electronic Communication Service” is defined as “any service that provides the user thereof 
the ability to send or receive wire or electronic communications.” 18 U.S.C. § 2510(15) 

B) “Remote Computing Service” is defined as the “provision to the public of computer storage or 
processing service by means of an electronic communication system ” 18 U.S.C. § 271 1(12) 

lb" 

18.6.4.3.4.2.2 (U) SUBSCRIBER INFORMATION 
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Ej (U//FOUOf 





F) (U//FOUOJ" 



1 





1 

1 

18 . 6 . 4 . 3 . 4 . 2.3 

1 

(V) Second generation connection records 

fe'/S 

iu//fouoi 







18 . 6 . 4 . 3 . 4 . 2.4 (U) Records or other information pertaining to a subscriber hi 

(U//FOUQ1 I 


18.6.4.3.4.2.5 (U) CONTENT 

(U//FOUO) Content is the actual substance of files stored in an account, including the 

subject line of an e-mail. 

A) (U) Unopened e-mail held in storage for 1 80 days or less may not be obtained using an 
administrative subpoena, A search warrant is required. 

B) (U) Unopened e-mai! that has been held in electronic storage for more than 1 80 days may be 
obtained with an administrative subpoena. (In the Ninth Circuit, the opened e-mail and un- 
opened e-mail must have been in storage for 180 days before it can be obtained with an 
administrative subpoena. See Theofel v. Farev-Jones. 359 F.3d 1066.) The government must 
provide notice to the subscriber or customer prior to obtaining such content. A limited 
exception to the notice requirement is provided in 18 U.S.C. § 2705. 

C) (U) E-mail that has been opened and the content of other electronically stored files held in 
storage by an entity that provides storage services to the public (i.e., a remote computing 
service, as defined in 18 U.S.C. § 271 1), may be obtained using an administrative subpoena 
with notice to the customer or subscriber, unless notice is delayed in accordance with 1 8 
U.S.C. § 2705. 
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D) (U) E-mail that has been opened and the content of other electronically stored files held in 
storage by an entity that does not provide electronic communication services to the public, 
such as that on the internal network of a business, may be obtained using an administrative 
subpoena. Notice to the individual is not required because this demand is not restricted by 
ECPA, 

(U) The FD-I035 administrative subpoena is not configured to obtain e-mail content 
because of developing case law in this area. This information may be obtain using an 
order issued under 18 U.S.C. § 2703(d). See DIOG Section 18.6.8.3. B. 

18 . 6 . 4 . 3 . 4.3 (U) Members of the News Media 

(U//FOUO) Approval Requirements : An administrative subpoena directed to a provider 
of electronic communication services or any other entity seeking to obtain local and long 
distance connection records, or records of session times of calls, made by a member of 
the news media may only be issued with the specific approval of the Attorney General. 
Before proposing such a subpoena, an agent should review 28 C.F.R. § 50.10. Requests 
for AG approval must be made by the AUSA involved in the investigation consistent 
with the DOJ policies set forth in 28 C.F.R. § 50.10. Guidance on the DOJ policy may be 
obtained from the Investigative Law Unit and/or the Privacy and Civil Liberties Unit, 
OGC. 


18.6.4,3,5 (U) Compliance/Monitoring 

18 . 6 . 4 . 3 . 5.1 (U) Limits on use 

(U//FQUOJ 


18 . 6 . 4 . 3 . 5.2 (U) Overproduction 

(U//FOUO) If any of the information that is obtained with an administrative subpoena is 
subject to statutory privacy protections (e.g., records subject to the Electronic 
Communications Privacy Act (ECPA), Right to Financial Privacy Act (RFPA), the Fair 
Credit Reporting Act (FCRA), Health Insurance Portability and Accountability Act 
(HIPAA), or the Buckley Amendment), it must be reviewed at the time it is received by 
the employee who requested the issuance of an administrative subpoena to ensure that the 
information received from the third party provider is within the scope of the request. Any 
information received from a third party provider that is beyond the scope of the 
administrative subpoena and is subject to statutory protections must be treated as an 
overproduction. If it is determined that the overproduced material is subject to statutory 
protection, then the all of the produced material must be sequestered with the employee’s 
supervisor and may not be uploaded into any FBI database or used in the investigation 
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until one the following methods of disposition have been completed at the discretion of 

the field office or FBIHQ division that issued the administrative subpoena: 

A) (U) The employee redacts the overproduced material. The employee’s supervisor must 
approve the scope of the redaction. If there is any question whether the information provided 
is within the scope of the administrative subpoena, the CDC or OGC must be consulted. The 
method of redaction is left to the discretion of the employee, but redacted information must 
not be visible, used in the investigation, or uploaded into any FBI database. The method of 
redaction will vary depending on whether the information was provided in hard copy or 
electronically. After the overproduced information has been redacted, the remainder of 
properly produced information may be uploaded into any database and used in the 
investigation; 

B ) (U1 I 


C) (U) The records are returned to the entity that produced them; or E 

D) (U) The records are destroyed 

(U) Whichever disposition is selected for the overproduction, it must be documented in 
the investigative subfile for administrative subpoenas. 

(U) Any questions concerning this process, including the review or disposition of the 
responsive records, or the statutes which cover such records, should be discussed with the 
CDC or OGC. 

18.6.4.3.5 3 (U) Factors for compliance 

(U//FOUO) The following factors should be considered to ensure compliance with 
applicable laws and regulations that govern the FBI’s use of administrative subpoenas: 

A) (U//FOUO) The administrative subpoena must relate to a type of investigation for which the 
subpoena is authorized; 

B) (U//FOUO) The administrative subpoena must be directed to a recipient to whom an 
administrative subpoena is authorized; 

C) (U//FOUO) The administrative subpoena may request only records that are authorized under 
the pertinent law; 

D) (U//FOUO) The administrative subpoena must be approved by an authorized official; 

E) (U//FOUO) The administrative subpoena must be uploaded into the ACS system to the 
Subpoena (“SBP”) subfile of the investigation for record purposes; 

F) (U//FOUO) The return of service information must be completed on the back of the original 
administrative subpoena; 

G) (U//FOUO) The original administrative subpoena and completed return of service must be 
maintained in a n SBP tt subfile of the investigation; and 
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H) (U//FOUO) If the records provided in response to the administrative subpoena are subject to 
statutory privacy protections, they must be reviewed to ensure that they are within the scope of 
the request (i.e., that there is no overproduction). If an over-production has occurred, the 
procedures outlined above must be followed. 
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18.6.5 (U) Investigative Method: Grand Jury Subpoenas (compulsory 

PROCESS) 

18.6.5.1 (U) Overview of Compulsory Process 

UJ//FOUOT — 




(Ull 

i 

1 

1 


18.6.5.2 

(U) Application 


(U//FOUOI 




1 — 

JA grand iurv subpoena may not be used for the collection of positive 


foreign intelligence. 


18.6.5.3 (U) Federal Grand Jury Subpoena 

18,6.53.1 (U) Legal Authorities 

(U) A Federal Grand Jury (FGJ) is an independent panel charged with determining whether 
there is probable cause to believe one or more persons committed a particular federal offense. 
If the FGJ believes probable cause exists, it will vote a “true bill” and the person will be 
indicted. An indictment is the most typical way a person is charged with a felony in federal 
court. A FGJ can collect evidence through the use of an FGJ subpoena, which is governed by 
Rule 6 of the FRCP. FRCP 6(e) controls the release of information obtained as part of the FGJ 
proceeding. FRCP 6(e) allows federal prosecutors to share foreign intelligence, 
counterintelligence, and terrorism-related threat information, and it is the DOJ's policy that 
such information should be shared to the fullest extent permissible by law and in a manner 
consistent with the rule. The Attorney General has issued revised Guidelines for the 
Disclosure and Use of Grand Jury Information under Rule 6(e)(3)(D) (hereinafter “FGJ- 
Guidelines”). A memorandum issued by the Deputy Attorney General on May 15, 2008, 
provides amplifying guidance. 
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18,6.53.2 (U) Scope 

(U//FOUO) FGJ subpoenas can be used to demand documents, records, testimony of 
witnesses, or any other evidence deemed relevant by a sitting grand jury. The FBI can request 
the issuance of an F GJ subpoena in coordination with the resno nsihlp I IS AO in all criminal 
investigative mattersl | 


| tuj suopoenas are part ot the investigative process. Thus, when an individual is 
indicted, turther FGJ subpoenas may not be issued that are related to those offenses. 
Additional subpoenas pertaining to this individual could be issued, however, for any crimes 
that continue to be investigated and have not yet been indicted. FGJ subpoenas cannot be used 
to gather evidence for trial; trial subpoenas must be used for that purpose (see Rule 17 Federal 
Rules of Criminal Procedure). 

18.6.533 (U) Approval Requirements 

(U) There are no FBI supervisory apprayaLimikettifnts, but all FGJ subpoenas must be 
issued by the USAO that is handling \h \ [ Assessment or Predicated Investigation 

to which the subpoenaed materials or witnesses are relevant. 

18.6.53.4 (U) Duration of Approval 

(U) FGJ subpoenas include a “return date,” which is the date on which the subpoenaed 
materials or testimony is due to the grand jury. 

18.6.53.5 (U) Specific Procedures 

(U) FGJ subpoenas are governed by Rule 6(e) of the Federal Rules of Criminal Procedure and 
can only be obtained in coordination with the responsible USAO or the appropriate DOJ 
division. 

18.6.5.3.5.1 (U) Members of the News Media 

(U) Approval Requirements : A grand jury subpoena directed to a provider of electronic 
communication services or any other entity seeking to obtain local and long distance 
connection records, or records of session times of calls, made by a member of the news media 
may only be issued with the specific approval of the Attorney General. Before proposing such 
a subpoena, an agent should review 28 C.F.R. § 50. 10. Requests for AG approval must be 
made by the AUSA involved in the investigation consistent with the DOJ policies set forth in 
28 C.F.R. § 50.10. Guidance on the DOJ policy may be obtained from the Investigative Law 
Unit and/or the Privacy and Civil Liberties Unit, OGC. 
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18.6.5.3.6 (U) Notice and Reporting Requirements 

(U) There is no FBI notice or reporting requirements for FGJ subpoenas. 

18.6.5.3.7 (U) Grand Jury Proceedings— Generally 

18.6.5.3.7.1 (U) Procedural Issues and Handling of FGJ Materials 

(U) The FGJ makes its determination whether to return a “true bill of indictment” based 
on evidence presented by the prosecuting attorney in an ex parte proceeding. The grand 
jury operates under the direction and guidance of the United States District Court. 
Generally, only witnesses for the prosecution testify before the grand jury. 

(U) Only the United States Attorney or an assistant, other DOJ attorneys prosecuting the 
matter, the witness under examination, an interpreter (as needed), and the stenographer or 
operator of a recording device may be present while the grand jury is in session. No judge 
is present during the presentation of evidence although the court will sometime rule on 
evidentiary issues and will provide initial instructions to the FGJ. No person other than 
the grand jurors may be present while the grand jury is deliberating or voting. 

18.6.5.3.7.2 (U) Restrictions on Disclosure 

(U) As a genera] rule, no one other than a grand jury witness may disclose matters 
occurring before the grand jury. Government agents, even if called as witnesses, may not 
disclose matters occurring before the grand jury. 

18.6.5.3.7.3 (U) Exceptions Permitting Disclosure 

18 . 6 . 5 . 3 . 7 . 3.1 (U) Disclosures by the government without the court’s 

permission 

(U//FOUO) The government, through its attorney, may disclose grand jury matters under 
the following conditions: 

A) (U) Under Rule 6(e)(3XA), the government may disclose a grand jury matter to certain 
persons in certain situations provided the government does not disclose the grand jury’s 
deliberations or any grand juror’s vote and the government provides the court that impaneled 
the grand jury with the names of all persons to whom disclosure was made and certifies that 
the government has advised the receiving party of the obligation of secrecy under this rule. 

B) (U) Persons eligible to receive material under this subsection are: 1) an attorney for the 
government for use in performing that attorney's duty; 2) any government personnel, including 
state, local, tribal, or foreign government personnel that an attorney for the government 
considers necessary to assist in performing that attorney's duty to enforce federal law; and 3) a 
person authorized under 18 U.S.C. § 3322. 

C) (U) For these purposes, OGC attorneys and CDCs are not "attorneys for the government." For 
purposes of the Rules of Criminal Procedure, FRCP 1 defines “attorney for the government” 
as ‘the Attorney General, an authorized assistant of the Attorney General, a United States 
Attorney, [and] an authorized assistant of the United States Attorney.” 


'.U 
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D) (U) An attorney for the government may disclose any grand jury matter to another FGJ. 

E) (U) An attorney for the government may disclose any grand jury matter involving foreign 
intelligence, counterintelligence, or foreign intelligence information to any federal law 
enforcement, intelligence, protective, immigration, national defense, or national security 
official to assist the official receiving the information in the performance of that official's 
duties. The government attorney must file, under seal, with the court that impaneled the grand 
jury, a notice that such information was disclosed and the agencies or departments that 
received the information. As used in Rule 6(e), foreign intelligence information is information 
that relates to the ability of the United States to protect against actual or potential attack or 
grave hostile acts by a foreign power or its agents; sabotage or international terrorism by a 
foreign power or its agents or clandestine intelligence activities by an intelligence service or 
network of a foreign power or its agents; or information with respect to a foreign power or 
foreign territory that relates to the national defense or security of the United States or the 
United States conduct of foreign affairs. 

F) (U) An attorney for the government may disclose any grand jury matter involving, either in 
the United States or elsewhere, a threat of attack or other grave hostile acts of a foreign power 
or its agent, a threat of domestic or international sabotage, or clandestine intelligence 
gathering activities by an intelligence service or network of a foreign power or by its agent to 
any appropriate federal, state, local, tribal, or foreign government official for the purpose of 
preventing or responding to such threat or activities. The government attorney must file, under 
seal, with the court that impaneled the grand jury, a notice that such information was disclosed 
and the agencies or departments that received the information, 

18.6.5.3. 7.3.2 (U) Disclosures by the government requiring the Court’s 

PERMISSION 

(U//FOUO) The government, through its attorney, may disclose grand jury matters under 
the following conditions only with permission of the court. Petitions to make these 
disclosures are generally, but not always, filed with the court that impaneled the grand 
jury. Unless the hearing on the government’s petition is to be ex parte, the petition must 
be served on all parties to the proceedings and the parties must be afforded a reasonable 
period of time to respond. 

A) (U) An attorney for the government may petition for disclosure to a foreign court or 
prosecutor for use in an official criminal investigation. 

B) (U) An attorney for the government may petition for disclosure to a state, local, tribal, or 
foreign government official, if the government attorney can show that the matter may disclose 
a violation of state, tribal, or foreign criminal law, and the purpose of the disclosure is to 
enforce that law. 

C) (U) An attorney for the government may petition for disclosure to an appropriate military 
official if the government attorney can show the matter may disclose a violation of military 
criminal law under the Uniform Code of Military Justice, and the purpose of the disclosure is 
to enforce that law. 

18.6.5.3. 7.3.3 (U) FBI’s CONDUIT RULE 

(U//FOUO) Only the federal prosecutor is authorized to make an initial disclosure of 
Rule 6(e)(3)(D) foreign intelligence information. As a practical matter, such disclosures 
are ordinarily accomplished through the FBI, which may have existing information- 
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sharing mechanisms with authorized receiving officials. If the prosecutor intends to share 
information directly with another official, consultation with the FBI is required to ensure 
that disclosures will be consistent with the existing policy of intelligence community 
agencies and to ensure appropriate handling of sensitive or class ified infnrmatmn 


b 


(U//FOUO) If, in cases of emergency, the prosecutor must disclose information before 
consulting with the FBI, the prosecutor must notify the FBI as soon as practicable. 


18.6J.3.7.3.4 (U) Other Limitations 

(U) Rule 6(e)(3)(D) does not eliminate certain other information protection requirements, 
such as restrictions on disclosure of tax returns and tax information, on certain financial 
information under the Right to Financial Privacy Act, and on classified information, to 
name only a few examples. Specific statutes may impose additional burdens of 
disclosures. 


18 . 6 . 5 . 3 . 7.4 (U) Disclosure 

A) (U) An FBI employee may become a “receiving official,” i.e., the person to whom grand jury 
information can be disclosed, if the FBI receives grand jury information developed during 
investigations conducted by other agencies. A receiving official is any federal, state, local, 
tribal, or foreign government official receiving grand jury information, disclosed by an 
attorney for the government, under any provision of Rule 6(e)(3)(D). A receiving official may 
only use the disclosed material as necessary in the conduct of his/her official duties. The 
receiving official ordinarily must consult with the federal prosecutor before disseminating the 
information publicly, including in open court proceedings. 

B) (U//FOUO) Receiving officials may only use grand jury information in a manner consistent 
with FGJ Guidelines and any additional conditions placed on the use or handling of grand juiy 
information by the attorney for the government. 

C) (U//FOUO) If dissemination is necessary to the performance of his or her official duties, a 
receiving official may disseminate Rule 6(e)(3XD) information outside of that official's 
agency to other government officials. 

D) (U) A receiving official, other than a foreign government official, must consult with the 
attorney for the government before disseminating Rule 6(e)(3)(D) information publicly 
(including through its use in a court proceeding that is open to or accessible to the public), 
unless prior dissemination is necessary to prevent harm to life or property. In such instances, 
the receiving official shall notify the attorney for the government of the dissemination as soon 
as practicable. 

E) (U) A foreign government receiving official must obtain prior consent from the disclosing 
official where possible, or if the disclosing official is unavailable, from the agency that 
disseminated the information to that foreign official before dissemination of the information to 
a third government or publicly. Public dissemination includes using the information in a court 
proceeding that is open to or accessible by the public. 
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F) (U) A receiving official shall handle Rule 6(eX3XD) information in a manner consistent with 
its sensitivity and shall take appropriate measures to restrict access to this information to 
individuals who require access for the performance of official duties. 

G) (U) A receiving official shall immediately report to the disclosing attorney for the 
government: any unauthorized dissemination of Rule 6(eX3XD) information; or any loss, 
compromise, or suspected compromise of Rule 6(eX3)(D) information. 

18*6*53.7.4.1 (U) Violations 

A) (U) A receiving official who knowingly violates Rule 6(e)(3)(D) by using the disclosed 
information outside the conduct of his or her official duties, or by failing to adhere to any 
limitations on the dissemination of such information, may be subject to contempt of court 
proceedings and to restriction on future receipt of Rule 6(e)(3)(D) information. 

B) (U) A state, local, tribal, or foreign government official who receives Rule 6(eX3XD) 
information, and who knowingly violates these guidelines, may be subject to contempt of 
court proceedings. 

C) (U) An attorney for the government who knowingly violates Rule 6(e)(3)(D) may be subject 
to contempt of court proceedings. 

18.6.53*7*4*2 (U) Limitation on Unauthorized Disclosures 

(U) Rule 6(e)(3)(D)(i) provides that receiving officials may use disclosed information 
only to conduct their “official duties subject to any limitation on the unauthorized 
disclosure of such information.” This “limitation on unauthorized disclosures” is 
understood to encompass applicable statutory, regulatory, and guideline restrictions 
regarding classification, privacy, or other information protection, as well as any 
additional restrictions imposed by the federal prosecutor. 

(U//FOUO) The FGJ Guidelines do not require the receiving official to notify the federal 
prosecutor of subsequent disclosures, except for consultation concerning public 
disclosures and consent for certain disclosures by foreign officials. The receiving official 
is bound by whatever restrictions govern his or her use and disclosure of the information 
as part of his official duties. (Memo dated 5/15/08. Guidel ines for the Disclosure and U se 
of FGJ Information under Rule 6felf 3irD1 ). 

18.6*53. 7*43 (U) Limitation of Use 

A) (U//FOUO) Because of the restrictions involved in handling information that is obtained by 
the use of a grand jury subpoena, whenever possible, alternatives to the grand jury subpoena, 
such as administrative subpoenas, search warrants and witness interviews should be 
considered as an alternative method of obtaining evidence. 

B) (U) A grand jury subpoena may only be used for purposes of gathering information that is 
relevant to the grand jury’s investigation. Grand jury secrecy continues indefinitely, regardless 
of whether there is an indictment, unless the material becomes a matter of public record, such 
as by being introduced at trial. 

C) (U) Rule 6(e)(3)(D) does not require notice to the court of subsequent dissemination of the 
information by receiving officials. 
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D) (U//FOUO) Disclosure of grand jury material cannot be made within the FBI for unrelated 
investigations unless a government attorney has determined that such disclosure to a particular 
investigator is needed to assist that attorney in a specific criminal investigation. The ability of 
government attorneys to freely share grand jury material with other government attorneys for 
related or unrelated criminal investigations does not extend to investigators without 
investigation specific authorization from the government attorney and notice to the court. 
Therefore, grand jury material must be restricted when placed into a general system of 
records that is freely accessible to FBI employees and others with access (e.g., ACS). 

E) (U//FOUO) If a government attorney authorizes the disclosure of grand jury materia] in the 
possession of the FBI for use in an unrelated federal criminal matter, such approval must be 
documented in the grand jury subfile of both the initiated investigation file and the subsequent 
investigation file. That documentation will be in addition to any necessary supplementation to 
the government attorney’s FRCP Rule 6(e) disclosure letter and/or to the internal disclosure 
list. 

F) (U//FOUO) The USAO should be consulted immediately for precautionary instructions if 
grand jury material will have application to civil law enforcement functions (e.g., civil RICO 
or civil forfeiture). There are very limited exceptions that allow government attorneys to use 
grand jury material or information in civil matters (e.g., civil penalty proceedings concerning 
banking law violations). These exceptions do not automatically apply to investigative 
personnel. Therefore, any similar use of grand jury information by the FBI must be approved 
in advance by the government attorney. 

G) (U//FOUO) Disclosure cannot be made without a court order for use in non-criminal 
investigations, such as background investigations or name checks. 

H) (U//FOUO) Government personnel who are preparing a response to a Freedom of Information 
Act or Privacy Act request may properly access grand jury material under the Rule because 
they are considered to be assisting the grand jury attorney by ensuring against any improper 
disclosure. 

18.6.53. 7.4.4 (U) Matters Occurring Before the Grand Jury 

A) (U) Core Grand Jury Material ; There can be no dissemination of matters occurring before the 
grand juiy unless such dissemination comes within one of the exceptions discussed above. 
There is no uniform legal definition of what constitutes matters occurring before the grand 
jury except for what is generally referred to as "core" grand jury material. “Core grand jury 
material” includes the following: (i) names of targets and witnesses; (ii) grand jury testimony; 
(iii) grand jury subpoenas; (iv) documents with references to grand jury testimony (including 
summaries and analyses); (v) documents that clearly reveal the intentions or direction of the 
grand jury investigation; and (vi) other material that reveals the strategy, direction, testimony, 
or other proceedings of a grand jury. 

B) (U) Documents Created Independent of Grand Jury but Obtained by Grand Jury Subpoena : 
Rule 6(e) generally prohibits disclosing ‘‘matters occurring before the grand jury.” The rule, 
however, does not define that phrase. The issue of whether pre-existing documents fall within 
that prohibition has never been settled conclusively by the Supreme Court, although many 
lower courts have discussed it at length. Courts generally agree that this prohibition does not 
cover all information developed in the course of a grand jury investigation; rather, the secrecy 
rule applies only to information that would reveal the existence, strategy or direction of the 
grand jury investigation, the nature of the evidence produced before the grand jury, the views 
expressed by members of the grand jury, or anything else that actually occurred before the 
grand jury. In addition, courts have frequently held that Rule 6(e) does not protect documents 
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subpoenaed by the government from third parties only for the information contained within 
the document rather than to determine the direction or strategy of the grand juiy investigation. 
Due to developing Law on this issue, FBI personnel should consult with the AUSA 
responsible, or the CDC/OGC, to determine how best to handle such documents. 

C) (U//FOUO) Data Extracted from Records Obtained by Grand Jury Subpoena : Information 
extracted from business records that were obtained by grand jury subpoena is often used to 
facilitate investigations. Some of that type of data is, by statute or case law, subject to grand 
jury secrecy rules. In other investigations, determination of whether data must be considered 
subject to grand jury secrecy rules depends on the case law and local practice in the federal 
district. Information extracted from grand jury subpoenaed financial records subject to the 
Right to Financial Privacy Act of 1978 (12 U.S.C. § 3420) must be treated as grand jury 
material “unless such record has been used in the prosecution of a crime for which the grand 
jury issued an indictment or presentment or for a purpose authorized bv rule 6fe^ of the 
Federal Rules of Criminal Procedure ." (emphasis added). Rule 6(eX3)(B) authorizes grand 
juiy material to be used "to assist an attorney for the government in performing that attorney's 
duty to enforce federal criminal law." Use of information obtained through a grand jury 
subpoena by FBI employees to advance an investigation does not constitute a disclosure of 
grand jury information in violation of Rule 6(e). With the approval of the US AO, information 
from subpoenaed telephone records may be disclosed for use in unrelated federal criminal 
investigations in those districts where such material is not considered a “matter occurring 
before a grand jury.” If the USAO approves generally of this procedure, such information may 
be used in unrelated criminal investigations without authorization from a government attorney 
in each instance. 

18.6.5.3 . 7.4.5 (U) Federal Grand Jury Physical Evidence and Statements of 

Witnesses 

A) (U) Physical evidence provided to the government in response to a grand jury subpoena is 
subject to the secrecy rule regardless of whether such evidence is presented to the grand jury. 
Physical evidence provided voluntarily or obtained by means other than grand jury process 
(such as by consent or a search warrant) is not a grand jury matter regardless of whether such 
evidence was previously or is thereafter presented to the grand jury. The fact that the physical 
evidence was presented to the grand jury is, however, subject to the grand jury secrecy rules. 

B) (U) Statements of witnesses obtained as a result of grand jury process including grand jury 
subpoena, such as a statement given in lieu of grand jury testimony, are matters occurring 
before the grand jury irrespective of whether such witnesses testified before the grand jury or 
are not required to testify. Voluntary statements of witnesses made outside of the grand jury 
context (not pursuant to any grand jury process including a grand jury subpoena), including 
statements made outside the grand jury by a witness who is being prepared for grand jury 
testimony, are not grand jury matters irrespective of whether the witness previously testified 
or will thereafter testify before the grand jury. 

C) (U) Rule 6(e)(3)(B) requires a federal prosecutor who discloses grand jury material to 
government investigators and other persons supporting the grand jury investigation to 
promptly provide the court that impaneled the grand jury the names of the persons to whom 
such disclosure has been made and to certify that he/she has advised such persons of their 
obligation of secrecy under the Rule. In order to document the certification required by the 
Rule, government attorneys often execute and deliver to the court a form, normally referred to 
as a “Certification” or “Rule 6(e) letter.” A copy of this document should be maintained with 
the grand juiy material held in the FBI's custody. 
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D) (U//FOUOJ Documentation of Internal Disclosures of Grand Jury Material: Grand jury 
material should be kept in such as fashion as to maintain the integrity of the evidence. Upon 
taking custody of grand jury material, the FBI employee should categorize it in a manner to 
identify its production source and how it was obtained, to include the identity of a custodian of 
record for documentaiy evidence. Practical considerations often require agents assisting 
government attorneys to seek assistance in the same investigation from others within the FBI. 
In many districts, support personnel and supervisors of case agents need not be routinely 
included in the list provided to the court. In lieu of a Rule 6(e) letter from the USAO 
containing an exhaustive list of names of FBI personnel, an FBI record of additional internal 
disclosures must be maintained by the case agent in order to establish accountability. Use of 
this "internal certification” procedure should be authorized by the appropriate USAO. The 
internal form must record the date of disclosure as well as the identity and position of the 
recipient. Such internal disclosures may be made only in support of the same investigation in 
which a federal prosecutor has previously issued a Rule 6(e) letter. In addition, the internal 
record must reflect that all recipients of grand jury materials were advised of the secrecy 
requirements of Rule 6(e). Whenever practicable, recipients should be listed on this internal 
certification prior to disclosure. Local Rule 6(e) customs should govern the internal 
certification process used. 

E) (U//FOUO) Storage of Grand Jury Material: The FBI cannot make or allow unauthorized 
disclosure of grand jury material. Materia! and records obtained pursuant to the grand jury 
process are frequently stored in FBI space. FBI personnel should report any unauthorized 
disclosure to the appropriate government attorney who, in turn, must notify the court. In order 
to protect against unauthorized disclosure, grand jury material must be secured in the 
following manner: 

1) (U//FOUO) The cover, envelope, or container containing grand jury materials must be 
marked with the warning: "GRAND JURY MATERIAL - DISSEMINATE ONLY 
PURSUANT TO RULE 6(e).” No grand jury stamp or mark should be affixed to the 
original material. Agents, analysts and other authorized parties should work from copies of 
grand jury material whenever possible to ensure the original material retains its integrity. 

2) (U//FOUO) Access to grand jury material must be limited to authorized persons (e.g,, 
those assisting an attorney for the government in a specific criminal investigation). All 
necessary precautions should be taken to protect grand jury material, to include 
maintaining the material in a secure location when not in use. The material must be 
appropriately segregated, secured, safeguarded and placed in the investigative subfile for 
FGJ material. Absent chain-of-custody considerations, grand jury material may be 
maintained in the 1 A section of the file. Grand jury material need not be kept in an 
evidence or bulky exhibit room and may be entrusted to a support services technician 
(SST) or evidence control technician (ECT). Should grand jury material be entered into a 
computer database, the data must be marked with the 6(e) warning and restricted within the 
system. 

3) (U//FOUO) Registered mail or other traceable courier (such as Federal Express) approved 
by the Chief Security Officer (CSO) must be used to mail or transmit to other field offices 
any documents containing grand jury material. Couriers and other personnel employed in 
these services will not be aware of the contents of the material transmitted because of the 
wrapping procedures specified below, and therefore, then do not require a background 
investigation, for this purpose. The names of persons who transport the material need not be 
placed on a disclosure list, but the receiving office must provide the case agent in the 
originating office with the names of personnel in the receiving office to whom disclosure is 
made. 
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4) (U//FOUO) Grand jury material that is to be mailed or transmitted by traceable courier 
outside a facility must be enclosed in opaque inner and outer covers. The inner cover must 
be a sealed wrapper or envelope that contains the addresses of the sender and the 
addressee, who must be authorized to have access to the grand jury material. The inner 
cover must be conspicuously marked "Grand Jury Information To Be Opened By 
Addressee Only." The outer cover must be sealed addressed, return addressed, and bear no 
indication that the envelope contains grand jury material. When the size, weight, or nature 
of the grand jury material precludes the use of envelopes or standard packaging, the 
material used for packaging or covering must be of sufficient strength and durability to 
protect the information from unauthorized disclosure or accidental exposure. 

5) (U//FOUO) If the government attorney determines that the sensitivity of, or threats to, 
grand jury material necessitates a more secure transmission method, the material may be 
transmitted by an express mail service approved for the transmission of national security 
information or be hand carried by the assigned government attorney or his or her 
designated representative. 

6) (U//FOUO) Grand jury material containing classified national security information must 
be handled, processed, and stored according to 28 C.F.R. Part 17. Grand jury material 
containing other types of sensitive information, such as federal tax return information, 
witness security information, and other types of highly sensitive information that have 
more stringent security requirements than that usually required for grand jury material 
must be stored and protected pursuant to the security regulations governing such 
information and any special security instructions provided by the organization that 
originated the information. 

7) (U//FOUO) Original documents that are obtained through the grand jury process should be 
returned to the attorney for the government or, with the government attorney's permission, 
to the owner if there is no indictment or the prosecution has concluded. 

18 . 6 . 5 . 3 . 7 . 4.6 (U) Requests for Subpoenas in Fugitive Investigations 

(U//FOUO) The function of the grand jury is to decide whether a person should be 
charged with a federal crime. Locating a person who has been charged is a task that is 
ancillary to, rather than a part of, that function. As such, grand jury subpoenas cannot be 
used as an investigative aid in the search for a fugitive in whose testimony the grand jury 
has no interest. Absent one the exceptions discussed below being applicable, grand jury 
subpoenas for testimony or records related a fugitive’s whereabouts may not be requested 
in FBI fugitive investigations. 

(U//FOUO) If the grand jury has a legitimate interest in the testimony of a fugitive 
regarding an ongoing investigation, it may subpoena other witnesses and records in an 
effort to locate the fugitive. In this situation, the responsible Assistant Attorney General 
must approve a "target" subpoena for the fugitive before the grand jury may subpoena 
witnesses and records to locate the fugitive. 

(U//FOUO) When a fugitive's present location is relevant to an offense under 
investigation, the grand jury may legitimately inquire as to the fugitive's whereabouts. 
Offenses such as harboring, misprision of a felony, and accessory after the fact are 
examples of crimes as to which the fugitive's location may be relevant evidence. If, 
however, the person who is suspected of harboring the fugitive or being an accessory 
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after the fact has been immunized and compelled to testify regarding the location of the 
fugitive, this will likely be viewed as improper subterfuge. 

(U//FOUO) DOJ policy generally forbids the use of grand jury subpoenas to locate a 
defendant charged in a federal criminal complaint with unlawful flight to avoid 
prosecution (UFAP). UFAP investigations are, as a general rule, not prosecuted Use of 
the grand jury in the investigation of a UFAP matter requires prior consultation with DOJ 
and written authorization to prosecute from the Assistant Attorney General in charge of 
the Criminal Division. Federal indictments for UFAP require prior written approval of 
the Attorney General, Deputy Attorney General, or an Assistant Attorney General. 

18.6.5,3.7.5 (U) Overproduction 

(U) If any of the information received in response to a FGJ subpoena is subject to 
statutory privacy protections (e.g., records subject to the Electronic Communications 
Privacy Act (ECPA), Right to Financial Privacy Act (RFPA), the Fair Credit Reporting 
Act (FCRA), Health Insurance Portability and Accountability Act (HIPAA), or the 
Buckley Amendment), it must be reviewed at the time it is received by the employee who 
requested the issuance of the FGJ subpoena to ensure that the information received is 
within the scope of the subpoena’s demand. Any information received from a third party 
provider that is beyond the scope of the FGJ subpoena and is subject to statutory 
protections must be treated as an overproduction. Overproduced material must not be 
uploaded into any FBI application database or used in any manner. Instead, the FBI 
employee must promptly notify the AUSA who authorized the issuance of the FGJ 
Subpoena of the potential overproduction. The AUSA, in coordination with the FBI 
employee, must determine whether the information exceeds the scope of the FGJ 
subpoena, and if so, how to dispose of the overproduced material. Whatever disposition 
of the overproduction is chosen it must be documented in the investigative subfile for 
FGJ subpoenas. 
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18.6.6 (U) Investigative Method: National Security Letter (compulsory 

process) 



18.6.6.2 (U) Application 

(U//FOUO) National Security Letters (NSLs) may be used in a national security Predicated 
Investigation. This method may not be used for assistance to other agencies, unless relevant to 
an already open FBI authorized investigation. 

18.6.6.3 (U) National Security Letters 

18.6.6.3.1 (U) Legal Authority 

A) (U) 12 U.S.C. § 3414(a)(5XA); 

B) (U) 15 U.S.C. §§ 1681u and 1681 v; 

C) (U) 18 U.S.C. § 2709; 

D) (U) 50 U.S.C. § 436; 

E) (U) AGG-Dom, Part V; and 

F) (U) A National Security Letter (NSL) may be used only to request: 

1) (U) Financial Records: The Right to Financial Privacy Act (RFPAI. 12 U.S.C. § 

3414(a)(5); 

2) (U) Identity of Financial Institutions: Fair Credit Reporting; Act (FCRA), 15 U.S.C. § 

L 68 1 u(a); 

3) (U) Consumer Identifying Information: FCRA, 15 U.S.C. § 1 68 1 u(b); 

4) (U) Identity of Financial Institutions and Consumer Identifying Information: FCRA, 15 
U.S.C. §§ 1681u(a)and (b); 

5) (U) Full Credit Reports in International Terrorism Investigations: FCRA, 1 5 U.S.C. § 

1681 v; and 
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6) (U) Telephone Subscriber Information, Toll Billing Records, Electronic Communication 
Subscriber Information, and Electronic Communication Transactional Records: Electronic 
Communications Privacy Act (ECPA), 18 U.S.C. § 2709* 

18.6.6.3.2 (U) Definition of Method 


(U) A National Security Letter (NSL) is an administrative demand for documents or records 
that are relevant to an authorized investigation to protect agai nst international terrorism or 
clandestine intelligence activities* Sample NSLs are available!"" 


1 8 : 6 . 6.3.3 (U) Approval Requirements 


(U//FOUO) The process for creating an NSL involves two documents: the NSL itself and the 
EC approving the issuance of the NSL. The authority to sign NSLs has been delegated to the 
Deputy Director, Executive Assistant Director, and Associate EAD for the National Security 
Branch; Assistant Directors and all DADs for CT/CD/Cyber; General Counsel; Deputy 
General Counsel for the National Security Law Branch; Assistant Directors in Charge in NY, 
WFO, and LA; and all SACs. This delegation includes FBI officials properly designated to 
serve in these positions in an acting capacity. No other delegations are permitted. The 
following requirements for designating an acting official are particular to NSLs and are more 
restrictive than the Succession and Delegation Policy set forth in DIOG Section 3: hi e 
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(U//FOUO) In addition to being signed by a statutorily-required approver, every NSL must be 
reviewed and approved by a CDC, ADC (or attorney acting in that capacity), or an NSLB 
attorney. 

18.6,6.3.4 (U) Standards for Issuing NSLs 

0Jj 1 
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(U//FOUO) As with all investigative methods, before requesting an NSL, the employee 
initiating the request should consider whether an NSL is the least intrusive and reasonable 
means based upon the circumstances of the investigation to obtain the needed information. 
See DIOG Section 4.4. 

1 8 : 6.6.3. 5 (U) Special Procedures for Requesting Communica tion Subscriber 

Information 
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U//FOUO) This list is not exhaustive 


18.6.6.3.7.2 (U) Copy of NSL 

(U//FOUO) A copy of the signed NSL must be retained in the investigative file and be 
uploaded under the appropriate NSL document type in ACS. Documented proof of 
service of NSLs must also be maintained in the NSL sub- file. 


18.6.63.7 3 (U) Second-Generation Information 



18.6.6.3.7.5 (U) Emergency Circumstances 


(U//FOUO) ECPA protects subscriber or communications transactional information from 
disclosure by providers of telephone or other electronic communication services. 
Generally, an NSL, grand jury subpoena, or another form of legal process must be used to 
compel a communication service provider to disclose subscriber or transactional 
information. In emergency circumstances, however, the provider may voluntarily disclose 
information to the FBI if the provider, in good faith, believes that an emergency 
involving danger of death or serious physical injury to any person exists and requires 
disclosure without delay. As a matter of FBI policy, when there is a danger of death or 

18-99 

UNCLASSIFIED - FOR OFFICIAL USE ONLY ,, " 




§18 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


serious physical injury that does not permit the proper processing of an NSL, an 
administrative subpoena (if permissible), a grand jury subpoena, or a letter to the provider 
citing 18 U.S.C. § 2702 may be used to request emergency disclosure, if approved by a 
SAC, ASAC, or FB1HQ Section Chief. If time does not permit the issuance of an 
emergency letter citing 18 U.S.C. § 2702, an oral request to the provider may be made, 
but the oral request mu st be followed-up with a letter to the particular provider. In either 
situation, ar| ""{Form, which automatically generates the letter, must be completed. 



b7E 


1 8. 6. 63.8 (U) Notice and Reporting Requirements 


(U//FOUO) The National Security Law Br anch at FBIH Q compiles NSL statistics for ^7 

reporting to Congress. The NSL subsystem T I automatical I v records the information 

needed for Congressional reporting. If the NSL is created outside the subsystem, the EC must 
include all information necessary for NSLB to report NSL statistics accurately. The EC must 
delineate the number of targeted phone numbers/e-mail accounts/financial accounts that are 
addressed to each NSL recipient. For example, if there are three targets, ten accounts, and six 
recipients of an NSL, the EC must state how many accounts are the subject of the NSL as to 
Recipient 1, Recipient 2, etc. It is not sufficient to indicate only that there are ten accounts and 
six recipients. 

(U//FOUO) In addition, the FBI must report the USPER status of the subject of all NSLs (as 
opposed to the target of the investigation), other than NSLs that seek only subscriber 
information. While the subject is often the target of the investigation, that is not always the 
case. The EC must reflect the USPER status of the subject of the request - the person whose 
information the FBI is seeking. If the NSL is seeking information about more than one person, 
the EC must reflect the USPER status of each person. (See the model ECs on the NSLB 
website .) 

18.6.63.9 (U) Receipt of NSL Information b e 
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18.6.6.3.11 (U) Dissemination ofNSL Material 


(U//FOUO) Subject to certain statutory limitations, information obtained in response to an 
NSL may be disseminated according to general dissemination standards in the AGG-Dom. 
The ECPA (telephone and electronic communications transactional records) and RFPA 
(financial records) permit dissemination if consistent with the AGG-Dom and the information 
is clearly relevant to the responsibilities of the recipient agency. FCRA permits dissemination 
of identity of financial institutions and consumer identifying information to other federal 
agencies as may be necessary for the approval or conduct of a foreign counterintelligence 
investigation. FCRA imposes no special rules for dissemination of full credit reports. 
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gjfi Fouoi 


18.6.6.3.13 (U) Payment forNSL-Derived Information 


(U//FOUO) No legal obligation exists for the FBI to compensate recipients of NSLs issued 
pursuant to ECPA (telephone and electronic communications transactional records) or FCRA, 
15 U.S.C. § 1681v (full credit reports in international terrorism investigations), and therefore 
no payment should be made in connection with those NSLs. See EC, 3 19X-HQ-A 1487720- 
OGC serial 222, for a form letter to be sent in response to demands for payment concerning 
these NSLs. 


(U//FOUO) Compensation is legally required for NSLs issued pursuant to RFPA (financial 
records) and FCRA § 1681u (identity of financial institutions and consumer identifying 
information). A fee schedule has been adopted under 12 C.F.R. § 219.3, Appendix A, and 
should be reviewed for the current reimbursement provisions. A copy of this fee schedule is 
available on the QGC website at; 


b'7E 
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18.6.7 (U) Investigative Method: FISA Order for Business Records 

(compulsory process) 

18.6.7.1 (U) Overview of Compulsory Process 


mz/FOiioi 1 ^ 

fUll 

1 

1 1 

tional security 

18.6.7.2 (U) Application 

(U//FOUO) FISA Business Records Orders may be used during authorized na 

investigations!^ 

^|When collecting positive fori 

rign 

suant to 50 

intelligence, if the subject is a non-USFEK. a request for business records pur 
U.S.C. §§ 1861-63 is lawful^ 

18.6.7.3 (U) Business Records Under FISA 

18.6. 7.3.1 (U) Legal Authority 
(U) 50 U.S.C. §§ 1861-63 

18.6.7.3.2 (U) Definition of Method 

(U) A FISA order for business records, is an order for a third party to produc< 

L 

■ ,1 

Irelevantto an authorized national security investigation! 
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18.6 . 7.3.4 (U) Duration of Court Approval 

(U) Authority for a FISA business records order is established by court order. 

18.6.7.3.5 (U) Notice and Reporting Requirements 
(U) There are no special notice or reporting requirements. 

1 8. 6. 7. 3. 6 (U) Compliance Requirements 


(U) The employee who receives material produced in response to a FISA business records 
order must do the following: 


A) (U//FOUO) Handle the material as requir ed by the Standard Minimization Procedure 
Adopted for Business Records Orders an <T 



1 8. 6. 7.3. 7 (U) FISA Overcollection 
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18.6.8 (U) Investigative Method: Stored Wire or Electronic 

Communications and Transactional Records 

18.6.8.1 (U) Summary 

(U//FOUO) FBI employees may acquire the contents of stored wire or electronic 
communications and associated transactional records — including basic subscriber 
information — as provided in 18 U.S.C. §§ 2701-2712 (Electronic Communications Privacy 
Act (ECPA)). Requests for voluntary disclosure under the emergency authority of 18 U.S.C. § 
2702 require prior approval from the field office ASAC or FBEHQ Section Chief when 
appropriate. 

(U//FOUO) All requests for information from electronic communication service providers 
(e.g., telephone companies, internet service providers) pertaining to a subscriber or customer 
must comply with ECPA. As used in ECPA, the term “information pertaining to a subscriber 
or customer^’ should be read broadly. It includes, for example, information regarding whether 
a particular individual has an account with a covered provider. Thus, unless done in 
accordance with ECPA, an FBI employee may not ask a telephone company or internet 
service provider whether John Smith has an account with the company (i.e., the FBI employee 
may not informally seek information that is statutorily protected prior to the issuance of 
appropriate process or the existence of an exception to ECPA). In addition, based on a 
November 5, 2008 interpretation of ECPA from the Office of Legal Counsel, the FBI may not 
ask a telephone company whether a given telephone number that the company services has 
been assigned to an individual. In short, in order to obtain any information specific to the 
subscriber from a telephone company or electronic communication service provider, the FBI 
must provide legal process pursuant to 18 U.S.C. §§ 2703 or 2709 or the request must fall 
within the limited exceptions established in 18 U.S.C. § 2702, and discussed below. 

to 

(U//FOUOI I 


18.6.8.2 (U) Application 

(U//FOUO)! 


I 

18.6.8.2.1 (U) Stored Data 

(U) The Electronic Communications Privacy Act (ECPA)— 18 U.S.C. §§ 2701-2712 — 
governs the disclosure of two broad categories of information: (i) the contents of wire or 
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electronic communications held in “electronic storage” by providers of “electronic 
communication service” or contents held by those who provide “remote computing service” 
to the public; and (ii) records or other information pertaining to a subscriber to or customer of 
such services. The category of “records or other information” can be subdivided further into 
subscriber records (listed in 18 U.S.C. § 2703(c)(2)) and stored traffic data or other records. 

(U) Records covered by ECPA include all records that are related to the subscriber, including 
buddy lists, “friend” lists (MySpace), and virtual property owned (Second Life). These other 
sorts of records are not subscriber records and cannot be obtained with a subpoena under 18 
U.S.C § 2703(c)(2) or an NSL under 18 U.S.C. § 2709. 

1 8.6.8.2.2 (U) Legal Process 

(U)The legal process for obtaining disclosure will vary depending on the type of information 
sought and whether the information is being voluntarily provided under 18 U.S.C. § 2702 
(e.g., with consent or when emergency circumstances require disclosure) or the provider is 
being compelled to provide the information under 18 U.S.C. § 2703, as outlined below. The 
process for compelling production under 18 U.S.C. § 2709 is discussed in the NSL section 
above. 


18.6.8.2.3 (U) Retrieval 

(U) Contents held in “electronic storage” by a provider of “electronic communication service” 
for 1 80 days or less can only be obtained with a search warrant based on probable cause. 
Accordingly, such records may only be obtained during a Full Investigation. 

(U) Contents held by those who provide “remote computing service” to the public and 
contents held in “electronic storage” for more than 180 days by an “electronic communication 
service” provider can be obtained with: a warrant; a subpoena with prior notice to the 
subscriber or customer; or an order issued by a court under 18 U.S.C. § 2703(d) when prior 
notice has been provided to the customer or subscriber (unless the court has authorized 
delayed notice). 

(U) Title 18 U.S.C. § 2705 establishes the standard to delay notice for an initial period of up 
to 90 days. Records or other information pertaining to a subscriber to or customer of such 
services, including basic subscriber information, can be obtained with a search warrant or an 
1 8 U.S.C. § 2703(d) order without notice. 

18.6.8.2.4 (U) Basic Subscriber Information 

(U) Basic subscriber information, as described in 18 U.S.C. § 2703(c)(2), can be compelled 
by a grand jury or administrative subpoena without notice. 

18.6.8.2.5 (U) Preservation of Stored Data 

(U) The government is authorized under 18 U.S.C. § 2703(f) to direct a provider to preserve 
records or other information (stored records or communications) in its possession for 90 days 
(which may be extended for an additional 90-days) pending issuance of applicable legal 
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process for disclosure. To make a preservation request, the FBI must believe that the records 
will subsequently be sought by appropriate legal process. 

18.6.8,2.6 (U) Cost reimbursement 

(U) 18 U.S.C. § 2706 requires the government to reimburse for costs incurred in providing the 
contents of communications, records, or other information obtained under 18 U.S.C. §§ 2702, 
2703, or 2704, except that reimbursement is not required for records or other information 
maintained by a communications common carrier that relate to telephone toll records and 
telephone listings obtained under 18 U.S.C. § 2703. In essence, the government does not have 
to reimburse for the cost of producing records that the provider maintains in the ordinary 
course of its business. 

18.6.8.3 (U) Legal Authority 

(U) 18 U.S.C §§ 2701-2712 
(U) AGG-Dom, Part V.9 

(U) ECPA^-18 U.S.C. §§ 2701-2712 — creates statutory privacy rights for the contents of 
communications in “electronic storage” and records or other information pertaining to a 
subscriber to or customer of an “electronic communication service” and a “remote computing 
service.” The statutory protections protect the privacy of an individual’s electronic data 
contained in a networked account — that may otherwise fall outside the scope of the 
protections afforded by the Fourth Amendment — when such account or its service is owned or 
managed by a third-party provider. 

(U) ECPA generally: (i) prohibits access to the contents of wire or electronic communications 
while in “electronic storage” unless authorized (18 U.S.C. § 2701); (ii) prohibits a provider of 
service to the public from disclosing the contents of wire or electronic communications while 
held in “electronic storage*” and prohibits divulging to the government any information 
pertaining to a subscriber to or customer of such service unless authorized (18 U.S.C. § 2702); 
and (iii) authorizes the government to compel disclosure from a provider of stored contents of 
a wire or electronic communication and records or other information pertaining to a 
subscriber to or customer (18 U.S.C. § 2703). ECPA provides for reimbursement of costs 
incurred in providing the information acquired. 



18.6.8.4 (U) ECPA Disclosures 


(U) ECPA authorities can be divided into two categories: (i) compelled disclosure — legal 
process to compel providers to disclose the contents of stored wire or electronic 
communications (including e-mail and voice mail — opened and unopened) and other 
information, such as account records and basic subscriber information; and (ii) voluntary 
disclosure of such information from service providers. Each of these authorities is discussed 
below. 


•>; 
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1 & 6.8 .4. 1 (U) Definitions 

A) (U) Electronic Storaee : is "any temporary, intermediate storage of a wire or electronic 
communication incidental to the electronic transmission thereof," or "any storage of such 
communication by an electronic communication service for purposes of backup protection of 
such communication." 18 U.S.C. § 2510(17). In short, "electronic storage" refers only to 
temporary storage, made in the course of transmission, by a provider of an electronic 
communication service. 

B) (U) Remote Computine Service (RCS); is a service that provides “to the public” computer 
storage or processing services by means of an electronic communications system. 18 U.S.C. § 
271 1(2). In essence, a remote computing service is an off-site computer that stores or 
processes data for a customer. 

C) (U) Electronic Communications System : is "any wire, radio, electromagnetic, photooptical or 
photoelectronic facilities for the transmission of wire or electronic communications, and any 
computer facilities or related electronic equipment for the electronic storage of such 
communications." 18 U.S.C. § 2510(14). 

D) (U) Electronic Communication Service (ECSU is "any service that provides to users thereof 
the ability to send or receive wire or electronic communications." 18 U.S.C. § 25 10(15). For 
example, telephone companies and electronic mail companies generally act as providers of 
electronic communication services. 

18.6.8.4.2 (U) Compelled Disclosure 

(U) 1 8 U.S.C. § 2703 lists five types of legal process that the government can use to compel a 
provider to disclose certain kinds of information. The five mechanisms, in descending order 
of required threshold showing are as follows: 

A) (U) Search warrant; 

B) (U) 18 U.S.C. § 2703(d) court order with prior notice to the subscriber or customer; 

C) (U) 18 U.S.C. § 2703(d) court order without prior notice to the subscriber or customer; 

D) (U) Subpoena with prior notice to the subscriber or customer; and 


E) (U) Subpoena without prior notice to the subscriber or customer. 



(U)l I 
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18.6.8.4.2.1 (U//FOUO) Notice— Orders Not to Disclose the Existence of a 

Warrant, Subpoena, or Court Order 

(U//FOUO) FBI employees may obtain a court order directing network service providers 
not to disclose the existence of compelled process if the government has no legal duty to 
notify the customer or subscriber of the process. If an 1 8 U.S.C. § 2703(d) order or 18 
U.S.C. § 2703(a) warrant is being used, a request for a non-disclosure order can be 
included in the application and proposed order or warrant. If a subpoena is being used to 
obtain the information, a separate application to a court for a non-disclosure order must 
be made. 


18.6.8.4.2.2 (U) Legal Standard 

(U//FOUO) A court may order an electronic communications service provider or remote 
computing service not to disclose the existence of a warrant, subpoena, or court order for 
such period as the court deems appropriate. The court must enter such an order if it 
determines that there is reason to bel ieve that notification of the existence of the warrant, 
subpoena, or court order will result in: 

A) (U) Endangering the life or physical safety of an individual; 

B) (U) Flight from prosecution; 

C) (U) Destruction of or tampering with evidence; 

D) (U) Intimidation of potential witnesses; or 

E) (U) Otherwise seriously jeopardizing an investigation or unduly delaying a trial. 18 U.S.C. § 
2705(b). 

18.6.8.4.2.3 (U) Search Warrant 

(U//FOUO) Investigators can obtain the full contents of a network account with a search 
warrant issued pursuant to FRCP Rule 41. However, FRCP Rule 41 search warrant may 
not be issued in Preliminary Investigations. See DIOG Section 18.7.1.3.4.4. 

18.6.8.4.2.4 (U) Court Order with Prior Notice to the Subscriber or 
Customer 

(U//FOUO) Investigators can obtain everything in a network account except for 
unopened e-mail or voice-mail stored with a provider for 180 days or less using a 1 8 
U.S.C. § 2703(d) court order with prior notice to the subscriber unless they have obtained 
authority for delayed notice pursuant to 18 U.S.C. § 2705. ECPA distinguishes between 
the contents of communications that are in "electronic storage" (e.g., unopened e-mail) 
for less than 180 days, and those that have been in "electronic storage" for longer or that 
are no longer in "electronic storage" (e.g., opened e-mail). 

(U) FBI employees who obtain a court order under 18 U.S.C. § 2703(d), and either give 
prior notice to the subscriber or comply with the delayed notice provisions of 1 8 U.S.C. § 
2705(a), may obtain: 
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A) (U) “The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for more than one hundred and eighty days.” 18 U.S.C. 

§ 2703(a), 

B) (U) "The contents of any wire or electronic communication" held by a provider of remote 
computing service "on behalf of . . . a subscriber or customer of such remote computing 
service," 18 U.S.C. §§ 2703(bXl)(B)(ii), 2703 (bX2); and 

C) (U) Everything that can be obtained using a 1 8 U.S.C. § 2703(d) court order without notice. ^ 

Ml ~1 



(U) To order delayed notice, the court must find that "there is reason to believe that 
notification of the existence of the court order may... endanger the life or physical safety 
of an individual; [lead to] flight from prosecution; [lead to] destruction of or tampering 
with evidence; [lead to] intimidation of potential witnesses; or . . . otherwise seriously 
jeopardiz[e] an investigation or unduly delay[ ] a trial." 18 U.S.C. §§ 2705(a)(1)(A) and 
2705(a)(2). The applicant must satisfy this standard anew each time an extension of the 
delayed notice is sought. 

18 . 6 . 8 . 4 . 2 . 4.2 (V) Nationwide Scope 

(U) Federal court orders under 18 U.S.C. § 2703(d) have effect outside the district of the 
issuing court. Orders issued pursuant to 18 U.S.C. § 2703(d) may compel providers to 
disclose information even if the information is stored outside the district of the issuing 
court. See 18 U.S.C. § 2703(d) ("any court that is a court of competent jurisdiction” may 
issue a 18 U.S.C. § 2703(d) order); 18 U.S.C. § 271 1(3) (court of competent jurisdiction 
includes any federal court having jurisdiction over the offense being investigated without 
geographic limitation). 

(U) 18 U.S.C. § 2703(d) orders may also be issued by state courts. See 18 U.S.C. §§ 

271 1(3), 3 127(2)(B). These orders issued by state courts, however, do not have effect 
outside the jurisdiction of the issuing state. See 18 U.S.C. §§ 271 1(3). 
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18.6.8.4.2.5 (U) Court Order without Prior Notice to the Subscriber or 

Customer 

(U) A court order under 18 U.S.C. § 2703(d) may compel disclosure of: 

A) (U) AH M record(s) or other information pertaining to a subscriber to or customer of such 
service (not including the contents of communications [held by providers of electronic 
communications service and remote computing service])," and 

B) (U) Basic subscriber information that can be obtained using a subpoena without notice. 18 
U.S.C. § 2703(c)(1). 

18.6.8.4.2,5.1 (U) Types of Transactional Records 

(U) The broad category of transactional records includes all records held by a service 
provider that pertain to the subscriber beyond the specific records listed in 2703(c)(2) 


i 


18.6.8.4.2.5.2 (U) Cell site and Sector Information 

(U) Cell site and sector information is considered “a record or other information 
pertaining to a subscriber” and therefore, production of historical and prospective cell site 
and sector information may be compelled by a court order under 18 U.S.C. § 2703(d). 
Requests made pursuant to 18 U.S.C. § 2703(d) for disclosure of prospective cell site and 
sector information — which is delivered to law enforcement under Communications 
Assistance for Law Enforcement Act (CALEA) at the beginning and end of calls — must 
be combined with an application for pen register/trap and trace device. Some judicial 
districts will require a showing of probable cause before authorizing the disclosure of 
prospective cell site and sector information. 

lb 7 

18.6.8.4.2.5.3 (U)\ ~| 
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18 . 6 . 8 . 4 . 2 . 5.4 (U) Legal Standard 


(U) A court order under 18 U.S.C. § 2703(d) is known as an "articulable facts" court 
order or simply a "d" order. This section imposes an intermediate standard to protect on- 
line transactional records. It is a standard higher than a subpoena, but not a probable 
cause warrant. 

(U) In applying for an order pursuant to 1 8 U.S.C. § 2703 (d), the FBI must state 
sufficient specific and articulable facts for the court to find that there are reasonable 
grounds to believe that the contents of a wire or electronic communication, or the records 



18.6.8.4.2.6 (U) Subpoena with Prior Notice to the Subscriber or Customer 


(U//FOUO) Investigators can subpoena opened e-mail from a provider if they give prior 
notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C. § 
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2705(a)-[ 


§18 

Jhat there is reason 1 


to believe notification of the existence of the subpoena may have an adverse result. 


(U) FBI employees who obtain a subpoena and give prior notice to the subscriber or 
comply with the delayed notice provisions of 18 U.S.C. § 2705(a) may obtain: 


A) (U) "The contents of any wire or electronic communication" held by a provider of remote 
computing service "on behalf of . . . a subscriber or customer of such remote computing 
service." 18 U.S.C. § 2703(b)(l)(B)(i), § 2703(bX2); 

B) (U) "The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for more than one hundred and eighty days." 1 8 U.S.C. 
§ 2703(a); and 



(U) Legal standards for delaying notice : The supervisory official must certify in writing 
that "there is reason to believe that notification of the existence of the court order may... 
endanger[] the life or physical safety of an individual; [lead to] flight from prosecution; 
[lead to] destruction of or tampering with evidence; [lead to] intimidation of potential 
witnesses; or... otherwise seriously jeopardizfe] an investigation or unduly delay[] a 
trial." 1 8 U.S.C. §§ 2705(a)(1)(A), 2705(a)(2). This standard must be satisfied anew 
every time an extension of the delayed notice is sought. This documentation must be 
placed with the subpoena in the appropriate investigative file. 

18.6.8.4.2.7 (U) Subpoena without Prior Notice to the Subscriber or 

Customer 


(U//FOUO) Without notice to the subscriber or customer, investigators can subpoena 
basic subscriber information: 

(U) name; address; local and long distance telephone connection records, or records of 
session times and durations; length of service (including start date) and types of service 
used; telephone or instrument number or other subscriber number or identity, including 
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any temporarily assigned network address; and means and source of payment for such 



A) (U) Legal Standard: The legal threshold for issuing a subpoena is relevance to the 

investigation. Courts are reluctant to review the “good faith” issuance of subpoenas as long as 
they satisfy the following factors 17 : (i) the investigation is conducted pursuant to a legitimate 
purpose; (ii) the information requested under the subpoena is relevant to that purpose; (iii) the 
agency does not already have the information it is seeking with the subpoena; and (iv) the 
agency has followed the necessary administrative steps in issuing the subpoena. 


(U//FOUO) In the event that a federal grand jury subpoena is used, however, appropriate 
protections against disclosure must be followed in compliance with FRCP Rule 6(e). 



C) (U) Members of the News Media : Approval of the Attorney general must be obtained prior to 
seeking telephone billing records of a member of the news media. (See DIOG Section 
18.6.5.1.5) 


18.6.8.4.3 (U) Voluntary Disclosure 



A) (U) Service NOT Available to the Public: ECPA does not apply to providers of services that 
are not available "to the public;" accordingly such providers may freely disclose both contents 
and other records relating to stored communications. Andersen Consulting v. UQP . 99 1 F. 
Supp. 1041 (N.D. 111. 1998) (giving hired consulting firm employees access to UOP*s e-mail 
system is not equivalent to providing e-mail to the public). 

B) (U) Services That ARE Available to the Public: If the provider offers services to the public, 
then ECPA governs the disclosure of contents and other records. 
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C) (U) If the provider is authorized to disclose the information to the government under 18 
U.S.C. § 2702 and is willing to do so voluntarily, law enforcement does not need to obtain a 
legal order or provide other legal process to compel the disclosure. 

D) (U) If a provider voluntarily discloses under the statute, there is no follow-up legal process 
required or available, If the provider, on the other hand, either may not or will not disclose the 
information voluntarily, FBI employees must rely on compelled disclosure provisions and 
obtain the appropriate legal orders. 

1) (U) Voluntary Disclosure of Stored Contents - ECPA authorizes the voluntary disclosure 

of stored contents when: 

a) (U) The originator, addressee, intended recipient, or the subscriber (in the case of 
opened e-mail) expressly or impliedly consents, 18 U.S.C. § 2702(b)(3); 

b) (U) The disclosure "may be necessarily incident to the rendition of the service or to the 
protection of the rights or property of the provider of that service," 18 U.S.C. § 
2702(b)(5); 

c) (U) The provider "in good faith, believes that an emergency involving danger of death 
or serious physical injury to any person requires disclosure without delay of information 
relating to the emergency,” 1 8 U.S.C. § 2702(bX8); 

d) (U//FOUO) An emergency disclosure under this statutory exception is justified when 
the circumstances demand action without delay to prevent death or serious bodily 



H.R Rep. No. 107-497 at 13- 14 (2002) accompanying The Cyber Security 
Enhancement Act of 2002, RR. 3482, which passed as part of the comprehensive 
Homeland Security Act of 2002, Pub. L. No. 107-296, § 225 1 16 Stat. 2135 (2002). 


e) (U) The disclosure is made to the National Center for Missing and Exploited Children, 
in connection with a report submitted thereto under Section 227 of the Victims of Child 
Abuse Act of 1990. (42 U.S.C. § 13032 and 18 U.S.C. § 2702[b][6]>; or 

f) (U) The contents are inadvertently obtained by the service provider and appear to 
pertain to the commission of a crime. Such disclosures can only be made to a law 
enforcement agency. 18 U.S.C. § 2702(b)(7) 

2) (U) Voluntary Disclosure of Non-Content Customer Records - ECPA permits a 

provider to voluntarily disclose non-content customer records to the government when: 

a) (U) The customer or subscriber expressly or impliedly consents, 1 8 U.S.C. § 

2702(c)(2); 

b) (U) The disclosure "may be necessarily incident to the rendition of the service or to the 
protection of the rights or property of the provider of that service," 1 8 U.S.C. § 
2702(c)(3); 

c) (U) The provider "in good faith, believes that an emergency involving danger of death 
or serious physical injury to any person requires disclosure without delay of information 
relating to the emergency,” 18 U.S.C. § 2702(c)(4); or 
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d) (U//FOUO) Note : An emergency disclosure under this statutory exception is justified 
when the circumstances demand immediate action (i.e., obtaining/disclosing 
information "without delay") to prevent death or serious bodily injury; the statute does 
not depend on the immediacy of the risk of danger itself. For example, an e-mail that 
discusses a planned terrorist attack but not the timing of the attack would constitute an 
emergency that threatens life or limb and requires immediate action, even though the 
timing of the attack is unknown. It is the need for immediate action to prevent the 
serious harm threatened rather than the immediacy of the threat itself that provides the 
justification for voluntary disclosures under this exception. H.R Rep. No. 107-497 at 
13-14 (2002) accompanying The Cyber Security Enhancement Act of 2002, H.R. 3482, 
which passed as part of the comprehensive Homeland Security Act of 2002, Pub. L. No. 
107-296, § 225 1 16 Stat. 2135 (2002). 

e) (U) The disclosure is to the National Center for Missing and Exploited Children, in 
connection with a report submitted thereto under Section 227 of the Victims of Child 
Abuse Act of 1990. (42 U.S.C. § 13032 and 18 U.S.C. § 2702[c][5]) 

3 ) (U) Preservation of Evidence under 18 U.S.C, § 2703ff> -T J 


■ ] nri ■ 

| A governmental entity is authorized to direct providers to 
preserve stored records and communications pursuant to 18 U.S.C. § 2703(f)- Once a 
preservation request is made, ECPA requires that the provider must retain the records 
for 90 days, renewable for another 90-day period upon a government request. See 18 
U.S.C. § 2703 (0(2). 


b ) (U) There is no legally prescribed format for 18 U.S.C. $ 2703ff) reouestsT 


c) (U) FBI employees who send 18 U.S.C. § 2703(f) letters to network service providers 
should be aware of two limitations. First, the authority to direct providers to preserve 
records and other evidence is not prospective. Thus, 18 U.S.C. § 2703(f) letters can 
order a provider to preserve records that have already been created but cannot order 
providers to preserve records not yet made. If FBI employees want providers to record 
information about future electronic communications, they must comply with the 
electronic surveillance statutes. A second limitation of 1 8 U.S.C. § 2703(f) is that some 
providers may be unable to comply effectively with 18 U.S.C. § 2703(f) requests 



4) (U) Video Tape Rental or Sales Records - 18 U.S.C. § 2710 makes the unauthorized 
disclosure of records by any person engaged in the rental, sale, or delivery of prerecorded 
video cassette tapes or similar audiovisual materials unlawful and provides an exclusionary 
rule to prohibit personally identifiable information otherwise obtained from being 
admissible as evidence in any court proceeding. Personally identifiable information is 
defined as "information that identifies a person as having requested or obtained specific 
video material or services . . . ." 
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a) (U) The disclosure to law enforcement of “personally identifiable information” is 
permitted only when the law enforcement agency: 

(i) (U) Has the written consent of the customer; 

(ii) (U) Obtains a search warrant issued under Rule 4 1 , FRCP or equivalent state 
warrant; or 

b7E 

(iii) (U) Serves a grand jury subpoena; 

b ) (U)l I 


c) (U) This type of information was specifically not included in the definition of 
’’personally identifiable information" to allow law enforcement to obtain information 
about individuals during routine investigations such as neighborhood investigations. 

d) (U//FOUO) The disclosure of “personally identifiable information” in a national 
security investigation may be compelled through use of the above legal processes or 
pursuant to a business records order issued under 50 U.S.C. § 1861. 

18.6.8.5 (U) Voluntary Emergency Disclosure 

18.6.8.5.1 (U) Scope 

(U//FOUO) ECPA protects subscriber and transactional information regarding 
communications from disclosure by providers of remote computing services or telephone or 
other electronic communication services to the public (remote computing services, telephone 
and other electronic communications services are hereafter col lectively referred to as 
“electronic communications service providers” or “providers”). Generally, an NSL, grand jury' 0 ° 
subpoena, or other form of legal proc ess must be used to compel the communication service 
provider to disclose such information! I 


(u//fouoJ 
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(U//FOU0J 


(U//FOUO) The use of thJ 


lis designed to captures all the information the FBI 


needs to satisfy statutory annual Congressional reporting requirements. 



(U) As authorized by statute (e.g., for as long as the emergency necessitating usage exists and 
only in those circumstances when it is impracticable to obtain other legal process such as a 
subpoena or NSL) and applicable court order or warrant 


18 . 6 . 8 . 5.3 (U) Specific Procedures 


hlK 


A ) (U//FOUO) Required Formj 
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B) (U//FOUO) Filing requirements, 



18.6.8.5.4 (U) Cost Reimbursement 


(U) Policy and procedures regarding cost reimbursement are described in the following: 

A) HJ) Standardized payment proced ures mav be found at , b i £ 



18.6.8.5.5 (U) Notice and Reporting Requirements 

18.6.8.5.6 (U) Reporting Voluntary Emergency disclosures 

(U) 1 8 U.S.C. § 2702(d) requires the Attorney General to report annually to Congress 
information pertaining to the receipt of voluntary disclosures of the contents of stored wire or 
electronic communications in an emergency under 18 U.S.C. § 2702(b)(8), specifically: 

A) (U) The number of accounts from which the FBI received voluntary emergency disclosures; 
and 

B) (U) A summary of the basis for the emergency disclosure in those investigations that were 
closed without the filing of criminal charges. 

(U) The ) 1 Form will capture information required to meet these reporting requirement. 

18.6.8.5.7 (U) Roles/Responsibilities b 

(U) Th \ I that hosts the l k ill, when necessary, follow- 

up with e-mail notifications to the issuing employee to ensure that the information included in 
the report to DOJ (which it uses to prepare the required Congressional report) is current. It is 
the responsibility of the FBI employee to respond to these requests for information as soon as 
practicable but no later than ten (10) business days. Failure to do so may be considered 
“substantial non-compliance” pursuant to Section 3. 

(U) OGC/ILB is assigned the administrative responsibility to complete the following by 
December 3 1 of each year: 

A) (U) Tabulate the number of voluntary disclosures of stored contents received under the 
authority of 18 U.S.C. § 2702(b)(8) for the calendar year; 
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B) (U) Prepare a report summarizing the basis for disclosure in those instances in which the 
relevant investigation was closed without the filing of criminal charges; and 

C) (U) Submit the report to the General Counsel for review and submission to DOJ according 
the statutory requirement for annual report by the Attorney General. 


18.6.8.6 (U) Other Applicable Policies 

(U) See then 


b7R 
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18.6.9 (U) Investigative Method: Pen Registers and Trap/Trace Devices 

(PR/TT) 

18.6.9.1 (U) Summary 

(U) Pen register and trap and trace (PR/TT) devices enable the prospective collection of non- 
content traffic information associated with wire and electronic communications, such a$: the 
phone numbers dialed from or to a particular telephone, including electronic communications; 
messages sent from or to a particular telephone; or the internet protocol (IP) address of 
communications on the Internet and other computer networks. 



18.6.9.3 (U) Legal Authority 

(U) 18 U.S.C. §§ 3121 et seq. and 50 U.S.C. §§ 1842 et seq. regulate the use of PR/TT 
devices. PR/TT orders authorize the collection of phone number dialed from or to a particular 
telephone, IP addresses, port numbers and the “To” and “From” information from e-mail; they 
cannot intercept the content of a communication, such as telephone conversations or the 
words in the “subject line” or the body of an e-mail. 

18.6.9.4 (U) Definition of Investigative Method 

(U) A pen register device or process records or decodes dialing, routing, addressing or 
signaling information transmitted by an instrument or facility from which a wire or electronic 
communication is transmitted, provided that such information must not include the contents of 
any communication. See 18 U.S.C. § 3127(3). 

(U) A trap and trace device or process captures the incoming electronic or other impulses that 
identify the originating number or other dialing, routing, addressing or signaling information 
reasonably likely to identify the source of a wire or electronic communication, provided that 
such information does not inc lude the contents of any communication. See 18 U.S.C. § 
3127(4). 

18.6.9.5 (U) Standards for Use and Approval Requirements for Investigative 
Method 

18.6.9.5.1 (U) Pen Register/Trap and Trace under FISA 

(U) Applications for authority to use a PRyTT device can be made to the FISC in national 
security investigations. See 50 U.S.C. § 1842. 
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18.6.9.5.1.1 (U) Legal Standard 


(U) Applications to the FISC are to be under oath and must include: 

A) (U) The identity of the federal officer making the application; and 

B) (U) A certification by the applicant that the information likely to be obtained is foreign 
intelligence information not concerning an USPER or is information that is relevant to an 
ongoing investigation to protect the United States against international terrorism or clandestine 
intelligence activities; and that such investigation, if of an USPER, is not conducted solely 
upon the basis of activities protected by the First Amendment to the Constitution. 

18.6.9.5.1.2 (U) Procedures 


(U//FOUCO Requests for opening or renewal of FISA PR/TT must be made using 



Twill route the request to appropriate parties for their review an d approval 
of the request | | Routing a 

paper copy for signatures is not required. 

18.6.9.5.1.3 (U) Emergency Authority— FISA: 50 U.S.C. § 1843 


h 1 E 


(U//FOUO) Under the provisions of FISA, the Attorney General may grant Emergency 
Authority (EA) for PR/TT. Requests for Emergency Authority must be referred to the 
appropriate FBIHQ division. 



A) (U) The Attorney General may authorize the installation and use of a PR/TT upon a 
determination that an emergency exists and that the factual basis exists for a court order. The 
FISC must be informed at the time of the authorization and an application for a court order 
must be made to the court as soon as practicable, but no more than seven (7) days after the 
authorization. If the court does not issue an order approving the use of a PR/TT, an 
emergency-authorized PR/TT use must terminate at the earliest of when the information 
sought is obtained, when the FISC denies the application, or seven (7) days after the Attorney 
General authorization is given. 

B) (U) If the FISC denies the application after an emergency PR/TT device has been installed, no 
information collected as a result may be used in any manner, except with the approval of the 
Attorney General upon a showing that the information indicates a threat of death or serious 
bodily harm to any person.. 
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(U) Notwithstanding the foregoing, the President, acting through the Attorney General, 
may authorize the use of a PR/TT, without a court order, for a period not to exceed 15 
calendar days, following a declaration of war by Congress. See 50 U.S.C. § 1 844. 

11 J//FOUOT For an emergency authorization to use a PR/TT surveillance] 

| at any time. 

18.6.9.5.1.4 (U) FISA OVERCOLLECTION 

(U//FOUO) In accordance with Foreign Intelligence Surveillance Court (FISC) Rule of 
Procedure 15, information acquired outside of the scope of the FISA authorization 
(“FISA overcollection”) will no longer be sequestered with the FISC, absent 
extraordinary circumstances. Contact NSLB for further guidance regarding the handling 
of any FISA overcollection. 

18 , 6 - 9 . 5.2 (U) Criminal Pen Register/Trap and Trace under Title 18 

(U) Applications for the installation and use of a PR/TT device may be made to a “court of 
competent jurisdiction” — i.e., “any district court of the United States (including a magistrate 
judge of such a court) or any United States court of appeals having jurisdiction over the 
offense being investigated, or any court of general criminal jurisdiction of a State authorized 
by the law of that State to enter orders authorizing the use of a pen register or trap and trace 
device ” See 18 U.S.C. § 3127(2). 

18.6.9.5.2.1 (U) Legal Standard 

(U) Applications for authorization to install and use a PR/TT device must include: 

A) (U) The identity of the attorney for the government or the state law enforcement or 
investigative officer making the application and the identity of the law enforcement agency 
conducting the investigation; and 

B) (U) A certification by the applicant that the information likely to be obtained is relevant to an 
ongoing criminal investigation being conducted by that agency. 

18.6.9.5.2.2 (U//FOUO) PROCEDURES 

(U//FOUO) An SSA must approve a request for opening or renewal of PR/TT use by EC 
prior to submission of the request to an attorney for the government. Before approving 
such a request, the SSA should consider of the following: 

A) (U//FOUO) The use of resources based on the investigative purpose set forth; 

B) (U//FOUO) Whether there is sufficient factual basis for the certification to be made in the 
application (i.e., is the information likely to be obtained relevant to an ongoing criminal 
investigation); 

C) (U//FOUO) Whether the customer or subscriber has consented to the use of a PR/TT, see 1 8 
U.S.C. § 3121(b)(3); or 
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D) (U//FOUO) Whether the use of a PR/TT is the least intrusive method if reasonable and 
effective based upon the circumstances of the investigation. 

(U//FOUO) A copy of the approving EC must be maintained in the pen register sub-file 
“PEN.” 

(U//FOUO) A PR/TT order is executable anywhere within the United States and, upon 
service, the order applies to any person or entity providing wire or electronic 
communication service in the United States whose assistance may facilitate the execution 
of the order. Whenever such an order is served on any person or entity not specifically 
named in the order, upon request of such person or entity, the attorney for the 
government or law enforcement or investigative officer that is serving the order must 
provide written or electronic certification that the order applies to the person or entity 
being served. 

18.6.9.5.2.3 (U) Emergency Authority — Criminal: 18 U.S.C. § 3125 

(U) The Attorney General, the Deputy Attorney General, the Associate Attorney General, 
any Assistant Attorney General, any acting Assistant Attorney General, or any Deputy 
Assistant Attorney General may specially designate any investigative or law enforcement 
officer to reasonably determine whether an emergency situation exists that requires the 
installation and use of a PR/TT device before an order authorizing such installation and 
use can, with due diligence, be obtained and there are grounds upon which an order could 
be entered authorizing the instal lation and use of a PR/TT. 

(U) An emergency situation as defined in this section involves: 

A) (U) Immediate danger of death or serious bodily injury to any person; 

B) (U) Conspiratorial activities characteristic of organized crime; 

C) (U) An immediate threat to a national security interest; or 

D) (U) An ongoing attack on a protected computer (as defined in 1 8 U.S.C. § 1030) that 
constitutes a crime punishable by a term of imprisonment greater than one year. 

(U) Only DOJ officials have the authority to authorize the emergency installation of a 
PR/TT. The FBI does not have this authority. If the DOJ authorizes the emergency 
installation of a PR/TT, the government has 48 hours after the installation to apply for 
and obtain a court order according to 18 U.S.C. § 3123. It is a violation of law to fail to 
apply for and obtain a court order within this 48 hour period. Use of the PR/TT shall 
immediately terminate when the information sought is obtained, when the application for 
a court order is denied, or if no court order has been obtained 48 hours after the 
installation of the PR/TT device in emergency situations. 

(U//FOUO) As with requesting authorization for an emergency Title ml I 

b7E 

| Once that 
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approval has been obtained, the DOJ attorney will advise the AUSA that the emergency 
use has been approved and that the law enforcement agency may proceed with the 
installation and use of the PR/TT. The DOJ attorney will send a verification 
memorandum, signed by the authorizing official, to the AUSA. The AUSA will include 
an authorization memorandum with the application for the court order approving the 
emergency use. 



18.6.9.6 (U) Duration of Approval 

A) (U) FISA: The use of a PR/TT device may be authorized by the FISC for a period of time not 
to exceed' 90 days in investigations targeting an USPER. Extensions may be granted for 
periods not to exceed 90 days upon re-application to the court. In investigations in which the 
applicant has certified that the information likely to be obtained is foreign intelligence 
information not concerning a U.S. person (USPER), an order or extension may be for a period 
of time not to exceed one year. 

B) (U) Criminal: The installation and use of a PR/TT device may be authorized by court order 
under 1 8 U.S.C. § 3123 for a period not to exceed 60 days, which may be extended for 
additional 60-day periods. 

18.6.9.7 (U) Specific Procedures 

(U//FOUO) Prior to installing and using a PR/TT device (whether issued in a criminal or 
national security matter), the case agent must: 
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E HU//FOUOll I 


18.6.9.8 (U) Use of FISA Derived Information in Other Proceedings 

(U//FOUO) There are statutory (50 U.S.C. Sections 1806, 1825, and 1845) and Attorney 
General (AG) policy restrictions on the use of information derived from a FISA ELSUR, 
physical search, or PR/TT. These restrictions apply to and must be followed by anyone 
“who may seek to use or disclose FISA information in any trial, hearing, or other 
proceeding in or before any court, department, officer, agency, regulatory body, or other 

authority of the United States ” See DIOG Appendix E for the AG Memo, Revised 

Policy on the Use or Disclosure of FISA Information, dated 01-10-2008. The guidance in 
the AG’s Memo establishes notification/approval procedures which must be strictly 
followed. Though not contained in the AG M emo. FBI policy requires that | 

| Q uestions concerning the FISA use policy or 

requests for assistance in obtaining FISA use authority from the AG should be directed to 
NSLB’s Classified Litigation Support Unit. 

(U//FOUO) The United States must, prior to the trial, hearing, or other proceeding or at a 
reasonable time prior to an effort to disclose or use that information or submit it into 
evidence, notify the “aggrieved person” [as defined in 50 U.S.C. Sections 1 80 1 (k), 

1 821(2), or 1 841(2)], and the court or other authority in which the information is to be 
disclosed or used, that the United States intends to disclose or use such information. See 
50 U.S.C. Sections 1806(c), 1825(d), and 1845(c). 

18.6.9.9 (U) Congressional Notice and Reporting Requirements 

18.6.9.9.1 (U) Criminal Pen Register/Trap and Trace- Annual Report 


(U) The Attorney General is required to make an annual report to Congress on the number of 
criminal PR/TT orders applied for by DOJ law enforcement agencies. See 18 U.S.C. § 3126. 
The report must include the following information: 


A) (U) The period of interceptions authorized by the order, and the number and duration of any 
extensions; 

B) (U) The offense specified in the order or application, or extension; 

C) (U) The number of investigations involved; 

D) (U) The number and nature of the facilities affected; and 

E) (U) The identity, including the district, of the applying agency making the application and the 
person authorizing the order. 

(U//FOUO) DOJ, Criminal Division, OEO requires the FBI to provide quarterly reports on 
pen register usage. To satisfy DOJ data requirements and standardize a nd simplify field 
reporting, court-ordered pen register usage must he rennrted to FBIHQ l | 

^ Jvithin five (5) workdays after the 

expiration date of an original order and any extensions, or denial of an application for an 
order. For all criminal PR/TT orders or extensions issued on or after January 1, 2009, the 
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1 These reporting requirements 

do not apply to PR/TT authorized pursuant to consent or under the provisions of FISA. 
18 , 6 , 9 . 9.2 (U) National Security Pen Registers and Trap and Trace - Semi-Annual 

(U) The Attorney General must inform the House Permanent Select Committee on 
Intelligence, Senate Select Committee on Intelligence, Committee of the Judiciary of the 
House Representatives, and Committee of the Judiciary of the Senate concerning all uses of 
PR/TT devices pursuant to 50 U.S.C. § 1846. This report is coordinated through DOJ NSD. A 
semi-annual report must be submitted that contains the following information: 

A) (U) The total number of applications made for orders approving the use of PR/TT devices; 

B) (U) The total number of such orders either granted, modified, or denied; and 

C) (U) The total number of PR/TT devices whose installation and use was authorized by the 
Attorney General on an emergency basis and the total number of subsequent orders approving 
or denying the installation and use of such PR/TT devices. 

18.6.9.10 (U) Post Cut-Through Dialed Digits (PCTDD) 

18 . 6 . 9 . 10.1 (U) Overview 

(U//FOUO) Telecommunication networks provide users the ability to engage in extended 
dialing and/or signaling (also known as "post cut-through dialed digits" or PCTDD), which in 
some circumstances are simply call-routing information and, in others, are call content. For 
example, non-content PCTDD may be generated when a party places a calling card, credit 
card, or collect call by first dialing a long-distance carrier access number and then, after the 
initial call is “cut through,” dialing the telephone number of the destination party. In other 
instances, PCTDD may represent call content, such as when a party calls an automated 
banking service and enters an account number, calls a pharmacy’s automated prescription 
refill service and enters prescription information, or enters a call-back number when prompted 
by a voice mail service. See United States Telecom Assn v. Federal Communications 
Commission. 227 F.3d 450. 462 (D.C. Cir. 2000). I 1 


(U//FOUO) The definition of both a pen register device and a trap and trace device provides 
that the information collected by these devices "shall not include the contents of any 
communication." See 18 U.S.C. § 3127(3) and (4). In addition, 18 U.S.C. § 3121(c) makes 
explicit the requirement to "use technology reasonably available" that restricts the collection 
of information "so as not to include the contents of any wire or electronic communications." 
"Content" includes any information concerning the substance, purport, or meaning of a 
communication. See 18 U.S.C. § 2510(8). When the pen register definition is read in 
conjunction with the limitation provision, however, it suggests that although a PR/TT device 
may not be used for the express purpose of collecting content, the incidental collection of 
content may occur despite the use of "reasonably available" technology to minimize, to the 
extent feasible, any possible over collection of content while still allowing the device to 
collect all of the dialing and signaling information authorized. 
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(U//FOUO'> DO J Policy: In addition to this statutory obligation, DOJ has issued a directive in 

I to ail DOJ agencies requiring that no 

affirmative investigative use may be made of PCTDD incidentally collected that constitutes 
content, except in cases of emergency — to prevent an immediate danger of death, serious 
physical injury, or harm to the national security. 



18.6.9.10.2 (U) Collection of PCTDD 


b?E 



18.6.9.10.3 (U) USEOF PCTDD 
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18.6.9.10.4 (U) WHAT CONSTITUTES PCTDD CONTENT 

(U//FOUO) In applying the above, the term “content” is interpreted to mean “any information 
concerning the substance, purport, or meaning of a communication” as defined in 18 U.S.C. § 

25 10. Questions concerning whether specific PCTDD are content as opposed to dialing, 
routing, addressing, or signaling information should be addressed to the CDC or OGC for 
coordination with DOJ as necessary. 

(U//FOUO)| | 

b7E 
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18.6.9.11.1 (U//FOUO) To Locate a Known Phone Number 


A) (U//FOUO) Authority : A standard PR/TT order issued pursuant to 1 8 U.SC. § 3 127 is 
adequate to authorize the use of this technology to determine the location of a known targeted 
phone, provided that the language authorizes FBI employees to install or cause to be installed 


and use a pen register device, without geographical limitation, at any time of day or night 
within (X) days from the date the order is signed, to record or decode dialing, routing, 
addressing, or signaling information transmitted by the “Subject Telephone.” Due to varying 
and often changing court interpretations of the requirements for obtaining cell site location 
information, agents contemplating legal process to obtain such information should consult as 
necessary with their CDC and/or AUSA for the legal requirements in their particular 
jurisdiction. The application and order should generally also request authority to compel 
disclosure of cell site location data on an ongoing basis under 1 8 U.S.C. § 2703(d) — or 
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18,6.9.11.3 (U) PR/TT ORDER LANGUAGE 

(U) The language in the order should state that "the pen register will be implemented 
unobtrusively and with minimum interference with the services accorded to customers of 
such service." 
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18.6.10 (U) Investigative Method: Mail Covers 

18.6.10.1 (U) Summary 


ML INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 08-31*2011 BY UC 60322 LP/PJ/SZ 


(U) A mail cover may be sought only in a Predicated Investigation when there are reasonable 
grounds to demonstrate that the mail cover is necessary to: (i) protect the national security; (ii) 
locate a fugitive; (iii) obtain evidence of the commission or attempted commission of a 
federal crime; or (iv) assist in the identification of property, proceeds or assets forfeitable 
because of a violation of criminal law. See 39 C.F.R. § 233.3(e)(2). 

id i 


i 



18.6.10.2 (U) Application 

(U//FOUOII 


3 


3b< i E 


18.6.10.3 (U) Legal Authority 

A) (U) Postal Service Regulation 39 C.F.R. § 233.3 is the sole authority and procedure for 
opening a mail cover and for processing, using and disclosing information obtained from a 
mail cover; 

B) (U) There is no Fourth Amendment protection for information on the outside of a piece of 
mail. See, e.g„ U.S. v. Choate. 57 6 F.2d 165, 174 (9 th Cir., 1978); and U.S. v. Huie. 593 F.2d 
14(5*Cir., 1979); and 

C) (U) AGG-Dom, Part V.A.2. 

18.6.10.4 (U) Definition of Investigative Method 

(U) A mail cover is the non-consensual recording of any data appearing on the outside cover 
of any sealed or unsealed mail matter to obtain information in order to: 

A) (U) Protect the national security; 

B) (U) Locate a fugitive; 
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C) (U) Obtain evidence of commission or attempted commission of a federal crime; 

D) (U) Obtain evidence of a violation or attempted violation of a postal statute; or 

E) (U) Assist in the identification of property, proceeds or assets forfeitable under law. 

See 39 C.F.R. § 233.3(c) (1). 

(U) In this context, a “recording” means the transcription, photograph, photocopy, or other 
facsimile of the image of the outside cover, envelope, or wrappers of mailed matter. A 
warrant or court order is almost always required to obtain the contents of any class of mail, 
sealed or unsealed. 

18.6.10.5 (U) Standard for Use and Approval Requirements for Investigative 

Method 



U//FOUO) Criminal Mail Cover . 
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(U//FOUO) Review and Approval of National Security or Criminal Mail Cover Requests : 
Approval of any mail cover request or extension is conditioned on the following criteria being 
met: 


A) (U//FOUO)[ 



b 7E 


b7E 


■b 7 E 


b7E 


| Under postal 

regulations, a mail cover must not include matter mailed between the mail cover subject and 
the subject's attorney, unless the attorney is also a subject under the investigation. 

G ) (U//FOUQ1 I 
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H )(U//FQUO)r 


I) (U//FQU0f 
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(U) Emergency Requests : When time is of the essence, the Chief Postal Inspector, or 
designee, may act upon an oral request to be confirmed by the requesting authority, in writing, 
within three calendar days. Information may be released prior to receipt of the written request 
only when the releasing official is satisfied that an emergency situation exists. See 39 C.F.R. § 
233.3(e)(3). 

(U) An “emergency situation” exists when the immediate release of information is required to 
prevent the loss of evidence or when there is a potential for immediate physical harm to 
persons or property. See 39 C.F.R. § 233.3(c)(l0). 


18.6.10.6 (U) Duration of Approval 

A) (U) National Security Mail Covers : No national security mail cover may remain in force for 
longer than 120 continuous days unless personally approved for further extension by the Chief 
Postal Inspector or his/her designees at National Headquarters. See 39 C.F.R. § 233.3(g)(6). 

B) (U) Criminal Mail Covers Except Fugitives : A mail cover in a criminal investigation is 
limited to no more than 30 days, unless adequate justification is provided by the requesting 
authority. See 39 C.F.R. § 233.3(gX5). Renewals may be granted for additional 30-day 
periods under the same conditions and procedures applicable to the original request. The 
requesting authority must provide a statement of the investigative benefit of the mail cover 
and anticipated benefits to be derived from the extension. 

C) (U) Fugitives : No mail cover instituted to locate a fugitive may remain in force for longer 
than 120 continuous days unless personally approved for further extension by the Chief Postal 
Inspector or his/her designees at National Headquarters. See 39 C.F.R. § 233.3(g)(6). 

D) (U) Exception for Indictments and Information : Except for fugitive investigations, no mail 
cover may remain in force when an information has been filed or the subject has been indicted 
for the matter for which the mail cover has been requested. If the subject is under investigation 
for further criminal violations, or a mail cover is required to assist in the identification of 
property, proceeds or assets forfeitable because of a violatio n of criminal law, a new mail 
cover order must be requested. See 39 C.F.R. § 233.3feY7bl 


b7E 


18.6.10.7 (U) Storage of Mail Cover Information 

(U//FOUO) The Postal Regulation requires that physical storage of all reports issued pursuant 
to a mail cover request to be at the discretion of the Chief Postal Inspector. See 39 C.F.R. § 
233.3(h)(1). Accordingly, FBI employees must conduct a timely review of mail cover 
documents received from the USPS. A copy of the signed mail cover request and the signed 
transmittal letter must be maintained in the investigative file. 
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18.6.10.8 (U) Return of Mail Cover Information to USPS 



18.6.10.9 (U) Compliance and Monitoring 

(U//FOUO) FBI employees must conduct a timely review of mail cover information received 
from the USPS for any potential production of data beyond the scope of the requested mail 
cover (“overproduction”). Overproduced information from a mail cover must not be uploaded 
into any FBI database or used in any manner. 
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18.6.1 1 (U) Investigative Method: Polygraph Examinations 

18.6.11.1 (U) Summary 

(U//FOUO) The polygraph examination is used in Predicated Investigations to: (i) aid in 
determining whether a person has pertinent knowledge of a particular matter under 
investigation or inquiry; (ii) aid in determining the truthfulness of statements made or 
information furnished by a subject, victim, witness, CHS, or an individual making allegations; 
and (iii) obtain information leading to the location of evidence, individuals or sites of offense. 



(U//FOUO) This policy does not limit other authorized uses of polygraph method outside of 
Assessments or Predicated Investigations, such as the FBI’s responsibilities to conduct 
background checks and inquiries concerning applicants and employees under federal 
personnel security programs. 

18.6.11.2 (U) Application 

(U//FOUO] | 

[lot otherwise prohibited by AGG-Dom, Part III. B. 2-3 

18.6.11.3 (U) Legal Authority 

(U) AGG-Dom, Part V.A.6. 

18.6.11.4 (U) Standards for Use and Approval Requirements for Investigative 
Method 


(U//FOUO) An SSA may approve the use of a polygraph if: 
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18.6.11.6 (U) Specific Procedures 

(U//FOUO) An EC must be prepared requesting SSA approval for the polygraph. If an AUSA 
is assigned to the investigation, an FBI employee must confer with the USAO to discuss any 
prosecutorial issues prior to the administration of a polygraph. 

18.6.11.7 (U) Compliance and Monitoring 
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18.6.12 (U) Investigative Method: Trash Covers (Searches that Do Not 

Require a Warrant or Court Order) 

18.6.12.1 (U) Summary 

(U) The Fourth Amendment to the United States Constitution prevents the FBI from 
conducting unreasonable searches and seizures. It also general ly requires a warrant be 
obtained if the search will intrude on a reasonable expectation of privacy. To qualify as a 
“reasonable expectation of privacy,” the individual must have an actual subjective expectation 
of privacy and society must be prepared to recognize that expectation as objectively 
reasonable. See Katz v. United States. 389 U.S. at 361. If an individual has a reasonable 
expectation of privacy, a warrant or order issued by a court of competent jurisdiction or an 
exception to the requirement for such a warrant or order is required before a search may be 
conducted. Physical searches of personal or real property may be conducted without a search 
warrant or court order if there is no reasonable expectation of privacy in the property or area. 
As a general matter, there is no reasonable expectation of privacy in areas that are exposed to 
public view or that are otherwise available to the public. 

(U//FOUO) Note: Consent Searches are authorized in Assessments, as well as in Predicated 
Investigations. 

(U) A reasonable expectation of privacy may be terminated by an individual abandoning 
property, setting trash at the edge of the curtilage or beyond for collection, or when a private 
party reveals the contents of a package. However, the AGG-Dom and FBI policy have 
restricted the use of 4t trash covers” to Predicated Investigations as set forth in this section. 


18.6.12.2 (U) Application 



18.6.12.3 (U) Legal Authority 

A) (U) AGG-Dom, Part V.A.3, 

B) (U) Fourth Amendment to the United States Constitution 


18.6.12.4 (U) Definition of Investigative Method 

18.6.12.4.1 (U) Distinction between * Trash Covers" and Searches of Abandoned 
Property or Trash 

A) (U//FOUO) Trash Cover : The intentional search of a specific person’s trash (that is located at 
the place for collection), whether from a home or business, designed to find information 
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relevant to an ongoing investigation when no reasonable expectation of privacy exists. A trash 
cover is a targeted effort to gather information regarding a particular person or entity by 
reviewing that person or entity’s refuse. Generally, a trash cover is a planned in advance 
activity based upon information obtained that a specific trash container will contain evidence 
or intelligence of an investigative interest, and that such activity will occur over a specified 
period of time. 

B) (U//FOUO) Search of Abandoned Property or Trash: A search of abandoned property or 
trash that has been placed in a publicly accessible garbage container is not a (4 trash cover” 
under the definition above. If an FBI employee observes an individual abandoning something, 
for example, in a publicly accessible garbage can, or observes possible evidence of a crime or 
something of intelligence value in a public trash receptacle, the FBI employee may recover the 
item(s) without having an Assessment or Predicated Investigation open at that time. 

18,6.12.4,2 (U) Determination of an Area of Curtilage Around a Home 

(U) Whether an area is curtilage around a home is determined by reference to four factors: (i) 
proximity of the area in question to the home; (ii) whether the area is within an enclosure 
surrounding the home; (iii) nature of the use to which the area is put; and (iv) steps taken to 
protect the area from observation by passers-by. 

(U) An area is curtilage if it is so intimately tied to the home itself that it should be placed 
under the home’s umbrella of Fourth Amendment protection. 

18.6.12.5 (U) Standards for Use and Approval Requirements for Investigative 

Method 

(U//FOUO) SSA approval is required for the use of this method. However, if there is a doubt 
as to whether a person has a reasonable expectation of privacy in the area to be searched, the 
employee must consult with the CDC or OGC to determine whether a search warrant is 
required. Use of this method must be documented in the investigative file. 
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18.6.13 (U) Investigative Method: Undercover Operations 

18,6.13.1 (U) Summary 



(U//FOUO) Undercover operations must be conducted in conformity with The Attorney 



UCO) in investigations relating to activities in violation of federal criminal law that do not 
concern threats to the national security or foreign intelligence. In investigations that concern 
threats to the national security or foreign intelligence, undercover operations involving 


religious or political organizations must be reviewed and approved by FBI Headquarters, with 
participation by the NSD in the review process. (AGG-Dom, Part V.A.7) Other undercover 
operations involving threats to the national security or foreign intelligence are reviewed and 
approved pursuant to FBI policy as described herein. 



18.6.13.2 (U) Legal Authority 

A) (U) AGG-Dom, Part V.A.7 

B) (U) AGG-UCO 


18.6.13.3 (U) Definition of Investigative Method 
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18.6.13.3.1 (U) Distinction Between Sensitive Circumstance and Sensitive Investigative 

Matter 



Undercover and Sensitive Operations (FGUSO), the NSUCOPG, and the FBIHQ operational 
division PGs. 

18.6.13.4 (U//FOUO) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR 
Investigative Method 

18.6.13 .4.1 (U) Standards for Use of Investigative Method 

(U//FOUO) An official considering approval or authorization of a proposed undercover 
application must weigh the risks and benefits of the operation, giving careful consideration to 
the following: 

A) (U//FOUO) The risks of personal injury to individuals, property damage, financial loss to 
persons or business, damage to reputation, or other harm to persons; 

B) (U//FOUO) The risk of civil liability or other loss to the government; 

C) (U//FOUO) The risk of invasion of privacy or interference with privileged or confidential 
relationships and any potential constitutional concerns or other legal concerns; 

D) (U//FOUO) The risk that individuals engaged in undercover operations may become involved 
in illegal conduct; and 

E) (U//FOUO) The suitability of government participation in the type of activity that is expected 
to occur during the operation. See AGG-UCO, Part IV.A. 

1 8.6.13.4.2 (U//FOUO) Approval Requirements for UCOs (investiga tions of viola tions 

OF FEDERAL CRIMINAL LAW THAT DO NOT CONCERN THREATS TO NATIONAL SECURITY 
OR FOREIGN INTELLIGENCE) 



b7E 
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EWU//FOUOlf 


18.6.13.5 (U'J Duration of Approval 

|(U//FOUOl~ 

18.6.13.6 (U) Additional Guidance 


A) (U//FOUO)r 


1 

i r 

1 

1 


B) (U//FOUO)r 


1 

i 

l i 

C) (U//FOUO)Q 


1 


18.6.13.7 (U) Compliance and Monitoring, and Reporting Requirements 

(U//FOUO) Al l UCOs must provide an| R ising the ] ~~| b 7 e 

to appropriate 
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18.7 (U) Authorized Investigative Methods in Full Investigations 

(U) See AGG-Dom, Part V.A.l 1-13. 

(U) In Full Investigations, to include Enterprise Investigations, the authorized investigative 
methods include; 

A) (U) The investigative methods authorized for Assessments. 

1) (U) Public information. (See Section 18.5.1) 

2) (U) Records or information - FBI and DOJ. (See Section 18.5.2) 

3) (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. (See Section 18.5.3) 

4) (U) On-line services and resources. (See Section 18.5.4) 

5) (U) CHS use and recruitment. (See Section 18.5.5) 

6) (U) Interview or request information from the public or private entities. (See Section 

18.5.6 ) 

7) (U) Information voluntarily provided by governmental or private entities. (See Section 

18.5.7) 

8) (U) Physical Surveillance (not requiring a court order). (See Section 18.5.8 ) 

B) (U) The investigative methods authorized for Preliminary Investigations. 

1) (U) Consensual monitoring of communications, including electronic communications. (See 
Section 18.6.1 ) 

2) (U) Intercepting the communications of a computer trespasser. (See Section 18.6.2) 

3) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (See Section 18.6.3) 

4) (U) Administrative subpoenas. (See Section 18.6.4) 

5) (U) Grand jury subpoenas. (See Section 18.6.5) 

6) (U) National Security Letters. (See Section 18.6.6) 

7) (U) FISA Order for business records. (See Section 18.6.7) 

8) (U) Stored wire and electronic communications and transactional records. (See Section 

18.6.8) 18 

9) (U) Pen registers and trap/trace devices. (See Section 18.6.9) 

10) (U) Mail covers. (See Section 18.6.10) 

1 1) (U) Polygraph examinations. (See Section 18.6.1 1) 

12) (U) Trash Covers (Searches that do not require a warrant or court order). (See Section 
18.6.12) 

13) (U) Undercover operations. (See Section 18.6.13) 

10 (U//FOUO) The use of Search Warrants to obtain this information in Preliminary Investigations is 
prohibited. (See DIOG Section 18.6.8.4.2.3) 
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C) (U) Searches - with a warrant or court order (reasonable expectation of privacy). (See Section 
18.7,1 below) 

D) (U) Electronic surveillance - Title III. (See Section 18.7.2 below) 

E) (U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). (See Section 18.7.3 below) 

(U//FOUO) Not all investigative methods are authorized while collecting foreign intelligence as 
part of a Full Investigation. See DIOG Section 9 for more information. 
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18.7.1 (U) Investigative Method: Searches - With a Warrantor Court 

Order (reasonable expecta tion of privacy) 

(U) See AGG-Dom, Part V.A.12 and the Attorney General's Guidelines On Methods Of 
Obtaining Documentary Materials Held By Third Parties, Pursuant to Title II, Privacy Protection 
Act of 1980 (Pub. L. 96-440, Sec. 201 et seq.; 42 U.S.C. § 2000aa-l 1, et seq.). 

18.7.1.1 (U) Summary 

(U) The Fourth Amendment to the United States Constitution governs all searches and 
seizures by government agents. The Fourth Amendment contains two clauses. The first 
establishes the prohibition against unreasonable searches and seizures. The second provides 
that no warrant (authorizing a search or seizure) will be issued unless based on probable 
cause. Although an unlawful search may not preclude a prosecution, it can have serious 
consequences for the government. These include adverse publicity, civil liability against the 
employee or the government and the suppression of evidence from the illegal seizure. 



(U) A search is a government invasion of a person’s privacy. To qualify as reasonable 
expectation of privacy, the individual must have an actual subjective expectation of privacy 
and society must be prepared to recognize that expectation as objectively reasonable. See 
Katz v. United States. 389 U.S. at 361. The ability to conduct a physical search in an area or 
situation where an individual has a reasonable expectation of privacy requires a warrant or 
order issued by a court of competent jurisdiction or an exception to the requirement for such a 
warrant or order. The warrant or order must be based on probable cause. The United States 
Supreme Court defines probable cause to search as a “fair probability that contraband or 
evidence of a crime will be found in a particular place.” Illinois v. Gates. 462 U.S. 213, 238 
(1983). A government agent may conduct a search without a warrant based on an individual’s 
voluntary consent. A search based on exigent circumstances may also be conducted without a 
warrant, but the requirement for probable cause remains. 

18.7.1.2 (U) Legal Authority 

(U) Searches conducted by the FBI must be in conformity with FRCP Rule 41; FISA, 50 
U.S.C. §§ 1821-1829; or E.O. 12333 § 2.5. 
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18.7.1.3 (U) Definition of Investigative Method 

(U) Physical Search defined : A physical search constitutes any physical intrusion within the 
United States into premises or property (including examination of the interior of property by 
technical means) that is intended to result in the seizure, reproduction, inspection, or alteration 
of information, material, or property, under circumstances in which a person has a reasonable 
expectation of privacy. 

(U) A physical search requiring a warrant does not include: (i) electronic surveillance as 
defined in FISA or Title III; or (ii) the acquisition by the United States Government of foreign 
intelligence information from international foreign communications, or foreign intelligence 
activities conducted according to otherwise applicable federal law involving a foreign 
electronic communications system, using a means other than electronic surveillance as 
defined in FISA. 

18. 7. 1.3.1 (U) Requirement for Reasonableness 


(U) By the terms of the Foi 
reasonable in its execution 

IIMSIM nuiwn» vra n • ■ iiu kihi* raKiu i mu m«j uugult Liu^H 

1 


r 

i 





18. 7. 1.3.2 (U) Reasonable Expectation of Privacy 


(U) The right of privacy is a personal right, not a property concept. It safeguards whatever an 
individual reasonably expects to be private. The protection normally includes persons, 
residences, vehicles, other personal property, private conversations, private papers and 
records. The Supreme Court has determined that there is no reasonable expectation of privacy 
in certain areas or information. As a result, government intrusions into those areas do not 
constitute a search and, thus, do not have to meet the requirements of the Fourth Amendment. 
These areas include: (i) open fields; (ii) prison cells; (iii) public access areas; and (iv) vehicle 
identification numbers. The Supreme Court has also determined that certain governmental 
practices do not involve an intrusion into a reasonable expectation of privacy and, therefore, 
do not amount to a search. These practices include: (i) aerial surveillance conducted from 
navigable airspace; (ii) field test of suspected control led substance; and (iii) odor detection. A 
reasonable expectation of privacy may be terminated by an individual taking steps to 
voluntarily relinquish the expectation of privacy, such as abandoning property or setting trash 
at the edge of the curtilage or beyond for collection. 

1 8. 7. 1.3.3 (U) Issuance of Search Warrant 

(U) Under FRCP Rule 41, upon the request of a federal law enforcement officer or an attorney 
for the government, a search warrant may be issued by: 

A) (U) a federal magistrate judge, or if none is reasonably available, a judge of a state court of 
record within the federal district, for a search of property or for a person within the district; 


li.iv 
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B) (U) a federal magistrate judge for a search of property or for a person either within or outside 
the district if the property or person is within the district when the wanant is sought but might 
move outside the district before the warrant is executed; 

C) (U) a federal magistrate judge in any district in which activities related to the terrorism may 
have occurred, for a search of property or for a person within or outside the district, in an 
investigation of domestic terrorism or international terrorism (as defined in 18 U.S.C. § 233 1); 
and 

D) (U) a magistrate with authority in the district to issue a warrant to install a tracking device. 

The warrant may authorize use of the device to track the movement of a person or property 
located within the district, outside, or both. 

(TJ) Physical searches related to a national security purpose may be authorized by the FISC. 

(50 U.S.C. §§ 1821-1829) 

18.7.1.3.4 (U) Property or Persons That May be Seized witha Warrant 

(U) A warrant may be issued to search for and seize any: (i) property that constitutes evidence 
of the commission of a criminal offense; (ii) contraband, the fruits of crime, or things 
otherwise criminally possessed; or (iii) property designed or intended for use or that is or has 
been used as the means of committing a criminal offense. In addition to a conventional search 
conducted following issuance of a warrant, examples of search warrants include: 

18.7.1.3.4.1 (U) Anticipatory Warrants 

(U) As the name suggests, an anticipatory warrant differs from other search warrants in 
that it is not supported by probable cause to believe that contraband exists at the premises 
to be searched at the time the warrant is issued. Instead, an anticipatory search warrant is 
validly issued where there is probable cause to believe that a crime has been or is being 
committed, and that evidence of such crime will be found at the described location at the 
time of the search, but only after certain specified events transpire. These conditions 
precedent to the execution of an anticipatory warrant, sometimes referred to as 
"triggering events," are integral to its validity. Because probable cause for an anticipatory 
warrant is contingent on the occurrence of certain expected or "triggering" events, 
typically the future delivery, sale, or purchase of contraband, the judge making the 
probable cause determination must take into account the likelihood that the triggering 
event will occur on schedule and as predicted. Should these triggering events fail to 
materialize, the anticipatory warrant is void. 

18.7.1.3.4.2 (U) Sneak and Peek Search Warrants 

(U) A sneak and peek search warrant allows law enforcement agents to surreptitiously 
enter a location such as a building, an apartment, garage, storage shed , etc., for the 
purpose of looking for and documenting evidence of criminal activity.! | 

b 7 E 
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18.7.1.3.4.3 (U) Mail Openings 

(U) Mail in United States postal channels may be searched only pursuant to court order, 
or presidential authorization. United States Postal Service regulations governing such 
activities must be followed. A search of items that are being handled by individual 
couriers, or commercial courier companies, under circumstances in which there is a 
reasonable expectation of privacy, or have been sealed for deposit into postal channels, 
and that are discovered within properties or premises being searched, must be carried out 
according to unconsented FISA or FRCP Rule 41 physical search procedures. 

18.7.1.3.4.4 (U) Compelled Disclosure of the Contents of Stored Wire or 
Electronic Communications 

(U) Contents in “electronic storage” (e.g., unopened e-mail/voice mail) require a search 
warrant. See 18 U.S.C. § 2703(a). A distinction is made between the contents of 
communications that are in electronic storage (e.g., unopened e-mail) for less than 180 
days and those in "electronic storage" for longer than 180 days, or those that are no 
longer in "electronic storage" (e.g., opened e-mail). In enacting the ECPA, Congress 
concluded that customers may not retain a "reasonable expectation of privacy" in 
information sent to network providers. However, the contents of an e-mail message that 
is unopened should nonetheless be protected by Fourth Amendment standards, similar to 
the contents of a regularly mailed letter. On the other hand, if the contents of an unopened 
message are kept beyond six months or stored on behalf of the customer after the e-mail 
has been received or opened, it should be treated the same as a business record in the 
hands of a third party, such as an accountant or attorney. In that case, the government 
may subpoena the records from the third party without running afoul of either the Fourth 
or Fifth Amendment. If a search warrant is used, it may be served on the provider without 
notice to the customer or subscriber. 

18. 7J.3.4.4.1 (U) Search Warrant 

(U//FOUO) Investigators can obtain the full contents of a network account with a search 
warrant. ECPA does not require the government to notify the customer or subscriber 
when it obtains information from a provider using a search warrant. Warrants issued 
under 18 U.S.C. § 2703 must either comply with FRCP Rule 41 or be an equivalent state 
warrant. Warrants issued pursuant to 1 8 U.S.C. § 2703 do not require personal service on 
the customer; the warrants are only be served on the electronic communication service or 
a remote computing service. FRCP Rule 41 requires a copy of the warrant be left with the 
provider, and a return and inventory be made. Federal courts have nationwide jurisdiction 
to issue these search warrants (see below). 

(U) With a search warrant issued based on probable cause pursuant to FRCP Rule 41 or 
an equivalent state warrant, the government may obtain: 
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A) (U) The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for one hundred and eighty days or less, and 

B) (U) Everything that can be obtained using a 18 U.S.C. § 2703(d) court order with notice. 

(U) In other words, every record and all of the stored contents of an account — including 
opened and unopened e-mail/voice mail — can be obtained with a search warrant based 
on probable cause pursuant to FRCP Rule 41. Moreover, because the warrant is issued by 
a neutral magistrate based on a finding of probable cause, obtaining a search warrant 
effectively insulates the process from challenge under the Fourth Amendment. 

18. 7.13.4.4.2 (U) Na TIONWIDE SCOPE 

(U) Search warrants under 18 U.S.C. § 2703(a) may be issued by a federal "court with 
jurisdiction over the offense under investigation," and may be executed outside the 
district of the issuing court for material responsive to the warrant. State courts may also 
issue warrants under 18 U.S.C. § 2703(a), but the statute does not give these warrants 
effect outside the issuing court’s territorial jurisdiction. As with any other FRCP Rule 41 
warrant, investigators must draft an affidavit and a proposed warrant that complies with 
FRCP Rule 41. 


18. 7.13.4.4.3 (U) Service of Process 

(U) 18 U.S.C. § 2703(a) search warrants are obtained just like any other FRCP Rule 41 
search warrant but are typically served on the provider and compel the provider to find 
and produce the information described in the warrant. ECPA expressly states that the 
presence of an officer is not required for service or execution of a search warrant issued 
pursuant to 18 U.S.C. § 2703(a). 

18. 7.13.4.4.4 (U) Court Order with Prior Notice to the Subscriber or 
Customer 

(U//FOUO) Investigators can obtain everything in a network account except for 
unopened e-mail or voice-mail stored with a provider for 180 days or less using a 18 
U.S.C. § 2703(d) court order with prior notice to the subscriber unless they have obtained 
authority for delayed notice pursuant to 18 U.S.C. § 2705. ECPA distinguishes between 
the contents of communications that are in "electronic storage" (e.g., unopened e-mail) 
for less than 180 days, and those that have been in "electronic storage" for longer or that 
are no longer in "electronic storage" (e.g., opened e-mail). 

(U) FBI employees who obtain a court order under 18 U.S.C. § 2703(d), and either give 
prior notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C. § 
2705(a), may obtain; 

A) (U) “The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for more than one hundred and eighty days.” 18 U.S.C. 

§ 2703(a). 
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B) (U) "The contents of any wire or electronic communication" held by a provider of remote 
computing service "on behalf of ... a subscriber or customer of such remote computing 
service," 18 U.S.C. §§ 2703(b)( 1 XB)(ii), 2703 (bX2); and 

C) (U) Everything that can be obtained using a 18 U.S.C. § 2703(d) court order without notice. 


(ui ~l 




1 


(U)[“ 

— 1 


18. 7,13.4,4.5 (U) Legal Standard 


b 7 F. 


b7E 


(U) To order delayed notice, the court must find that "there is reason to believe that 
notification of the existence of the court order may... endanger the life or physical safety 
of an individual; [lead to] flight from prosecution; [lead to] destruction of or tampering 
with evidence; [lead to] intimidation of potential witnesses; or . . . otherwise seriously 
jeopardiz[e] an investigation or unduly delay[ ] atrial." 18 U.S.C, §§ 2705(a)(1)(A) and 
2705(a)(2). The applicant must satisfy this standard anew each time an extension of the 
delayed notice is sought. 

18,7.13.43,6 (U) Nationwide Scope 

(U) Federal court orders under 18 U.S.C. § 2703(d) have effect outside the district of the 
issuing court. Orders issued pursuant tol8 U.S.C. § 2703(d) may compel providers to 
disclose information even if the information is stored outside the district of the issuing 
court. See 18 U.S.C. § 2703(d) ("any court that is a court of competent jurisdiction" may 
issue a 18 U.S.C. § 2703[d] order); 18 U.S.C. § 271 1(3) (court of competent jurisdiction 
includes any federal court having jurisdiction over the offense being investigated without 
geographic limitation). 

(U) 18 U.S.C, § 2703(d) orders may also be issued by state courts. See 18 U.S.C. §§ 

271 1(3), 3127(2)(B). Such orders issued by state courts, however, do not have effect 
outside the jurisdiction of the issuing state. See 18 U.S.C, §§ 271 1(3). 

18. 7.13.4.4. 7 (U) Court Order without Prior Notice to the Subscriber or 

Customer 


(U) A court order under 18 U.S.C. § 2703(d) may compel disclosure of; 
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A) (U) All "record(s) or other information pertaining to a subscriber to or customer of such 
service (not including the contents of communications [held by providers of electronic 
communications service and remote computing service]),” and 

B) (U) Basic subscriber information that can be obtained using a subpoena without notice. 18 
U.S.C. § 2703(cXO- 

18.7.1.4 (U) Approval Requirements for Investigative Method 

A) (U//FOUO) Search warrants issued under authority of FRCP Rule 41 ; A warrant to search 
is issued by a federal magistrate (or a state court judge if a federal magistrate is not reasonably 
available). Coordination with the USAO or DOJ is required to obtain the warrant. 

B) (U//FOUO) FISA: In national security investigations, field office requests for FISA 

authorized physical searches must be submitted to FBIHQ using the FB I FISA Request Form . :- b 7 1 

Field office requests for FISA approval are tracked through |~ | This form should be 
completed by the case agent. 

C) (U//FOUO) Sensitive Investigative Matters (SIM) : Notice to the appropriate FBIHQ 
operational Unit Chief and Section Chief is required if the matter under investigation is a 
sensitive investigative matter. Notice to DOJ is also required, as described in DIOG Section 
10 . 

18.7.1.5 (U) Duration of Approval 

(U) The duration for the execution of a warrant is established by the court order or warrant. 

18.7.1.6 (U) Specific Procedures 

18.7.1.6.1 (U) Obtaining a Warrant under FRCP Rule 41 

18 . 7 . 1 . 6 . 1.1 (U) Probable Cause 

(U//FOUO) After receiving an affidavit or other information, a magistrate judge or a 
judge of a state court of record must issue the warrant if there is probable cause to search 
for and seize a person or property under FRCP Rule 41(c). Probable cause exists where 
“the facts and circumstances within the FBI employee’s knowledge, and of which they 
had reasonably trustworthy information are sufficient in themselves to warrant a person 
of reasonable caution in the belief that.. .” a crime has been or is being committed, and 
that sizable property can be found at the place or on the person to be searched. Probable 
cause is a reasonable belief grounded on facts. In judging whether a reasonable belief 
exists, the test is whether such a belief would be engendered in a prudent person with the 
officer’s training and experience. To establish probable cause, the affiant must 
demonstrate a basis for knowledge and belief that the facts are true and that there is 
probable cause to believe the items listed in the affidavit will be found at the place to be 
searched. 


18 . 7 . 1 . 6 , 1.2 (U) Requesting a Warrant in the Presence of a Judge 

A) (U) Warrant on an Affidavit : When a federal law enforcement officer or an attorney for the 
government presents an affidavit in support of a warrant, the judge may require the affiant to 
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appear personally and may examine under oath the affiant and any witness the affiant 
produces. 

B) (U) Warrant on Sworn Testimony : The judge may wholly or partially dispense with a written 
affidavit and base a warrant on sworn testimony if doing so is reasonable under the 
circumstances. 

C) (U) Recording Testimony : Testimony taken in support of a warrant must be recorded by a 
court reporter or by a suitable recording device, and the judge must file the transcript or 
recording with the clerk, along with any affidavit. 

18.7.1.6.1.3 (U) Requesting a Warrant by Telephonic or Other Means 

A) (U) In General : A magistrate judge may issue a warrant based on information communicated 
by telephone or other appropriate means, including facsimile transmission. 

B) (U) Recording Testimony : Upon learning that an applicant is requesting a warrant, a 
magistrate judge must: (i) place under oath the applicant and any person on whose testimony 
the application is based; and (ii) make a verbatim record of the conversation with a suitable 
recording device, if available, or by a court reporter, or in writing. 

C) (U) Certifying Testimony : The magistrate judge must have any recording or court reporter's 
notes transcribed, certify the transcription’s accuracy, and file a copy of the record and the 
transcription with the clerk. Any written verbatim record must be signed by the magistrate 
judge and filed with the clerk. 

D) (U) Suppression Limited : Absent a finding of bad faith, evidence obtained from a warrant 
issued under FRCP Rule 41(dX3XA) is not subject to suppression on the ground that issuing 
the warrant in that manner was unreasonable under the circumstances. 

18.7.1.6.1.4 (U) Issuing the Warrant 

(U) In general, the magistrate judge or a judge of a state court of record must issue the 
warrant to an officer authorized to execute it. The warrant must identify the person or 
property to be searched, identify any person or property to be seized, and designate the 
magistrate judge to whom it must be returned. The warrant must command the officer to: 
(i) execute the warrant within a specified time no longer than 10 days; (ii) execute the 
warrant during the daytime, unless the judge for good cause expressly authorizes 
execution at another time; and (iii) return the warrant to the magistrate judge designated 
in the warrant. 

18.7.1.6.1.5 (U) Warrant by Telephonic or Other Means 

(U) If a magistrate judge decides to proceed under FRCP Rule 41(d)(3)(A), the fol lowing 
additional procedures apply: 

A) (U) Preparing a Proposed Duplicate Original Warrant : The applicant must prepare a 
"proposed duplicate original warrant" and must read or otherwise transmit the contents of that 
document verbatim to the magistrate j udge. 

B) (U) Preparing an Original Warrant : The magistrate judge must enter the contents of the 
proposed duplicate original warrant into an original warrant. 
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C) (U) Modifications: The magistrate judge may direct the applicant to modify the proposed 
duplicate original warrant. In that case, the judge must also modify the original warrant. 

D) (U) Sienine the Original Warrant and the Duplicate Original Warrant : Upon determining to 
issue the warrant, the magistrate judge must immediately sign the original warrant, enter on its 
face the exact time it is issued, and direct the applicant to sign the judge's name on the 
duplicate original warrant. 

18.7.1.6.1.6 (U) Executing and Returning the Warrant 

A) (U) Notine the Time : The officer executing the warrant must enter on its face the exact date 
and time it is executed. 

B) (U) Inventory : An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized. The officer must do so in the presence of another officer 
and the person from whom, or from whose premises, the property was taken. If either one is 
not present, the officer must prepare and verify the inventory in the presence of at least one 
other credible person. 

C) (U) Receipt : The officer executing the warrant must: (i) give a copy of the warrant and a 
receipt for the property taken to the person from whom, or from whose premises, the property 
was taken; or (ii) leave a copy of the warrant and receipt at the place where the officer took the 
property. 

D) (U) Return : The officer executing the warrant must promptly return it — together with a copy 
of the inventory — to the magistrate judge designated on the warrant. The judge must, on 
request, give a copy of the inventory to the person from whom, or from whose premises, the 
property was taken and to the applicant for the warrant. 

18.7.1.6.1.7 (U) Forwarding Papers to the Clerk 

(U) The magistrate judge to whom the warrant is returned must attach to the warrant a 

copy of the return, the inventory, and all other related papers and must deliver them to the 

clerk in the district where the property was seized. (FRCP Rule 41) 

18.7.1.6.1.8 (U) Warrant for a Tracking Device 

A) (U) Notine the Time : The officer executing a tracking device warrant must enter on it the 
exact date and time the device was installed and the period during which it was used. 

B) (U) Return : Within 10 calendar days after the use of the tracking device has ended, the officer 
executing the warrant must return it to the judge designated in the warrant. 

C) (U) Service : Within 10 calendar days after use of the tracking device has ended, the officer 
executing the warrant must serve a copy of the warrant on the person who was tracked. 

Service may be accomplished by delivering a copy to the person who, or whose property was 
tracked; or by leaving a copy at the person’s residence or usual place of abode with an 
individual of suitable age and discretion who resides at that location and by mailing a copy to 
the person’s last known address. Upon request of the government, the judge may delay notice 
as provided in FRCP Rule 41(f)(3). 
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18.7.1.6.1.9 (U) Delayed Notice 

(U) Upon the government's request, a magistrate judge — or if authorized by FRCP Rule 
41(b), a judge of a state court of record — may delay any notice required by FRCP Rule 
41 if the delay is authorized by statute. 

18 : 7. 1.6.2 (U) Obtaining a FISA Warrant 

(U) Applications for court-authorized physical search pursuant to FISA must be made by a 
federal officer in writing upon oath or affirmation and with the specific approval of the 
Attorney General. (See 50 U.S.C. § 1823). 

18.7.1.6.2.1 (U) Certificate by The Director of the FBI 

(U) Each FISA application must be accompanied by a Certification by the Director of the 
FBI or one of nine other individuals authorized by Congress or the President to provide 
such certifications that: the information being sought is foreign intelligence information; 
that a significant purpose of the search is to obtain foreign intelligence information; that 
such information cannot reasonably be obtained by normal investigative techniques; that 
the information sought is "foreign intelligence information" as defined by FISA. The 
certification must include a statement explaining the certifier's basis for the certification. 

(U) 50 U.S.C. § 1823 specifies the Assistant to the President for National Security 
Affairs; E.O. 12139 as amended by E.O. 13383 specifies the Director of the FBI, Deputy 
Director of the FBI, the Director of National Intelligence, the Principal Deputy Director 
of National Intelligence, the Director of the Central Intelligence Agency, the Secretary of 
State, the Deputy Secretary of State, the Secretary of Defense, and the Deputy Secretary 
of Defense as appropriate officials to make certifications required by FISA. The FBI 
Director has represented to Congress that the FBI deputy Director will only certify 
FISA’s when the FBI Director is not available to do so. 

18.7.1.6.2.2 (U) Length of Period of Authorization for FISC Orders 

(U) Generally, a FISC Order approving an unconsented physical search will specify the 
period of time during which physical searches Eire approved and provide that the 
government will be permitted the period of time necessary to achieve the purpose, or for 
90 days, whichever is less, except that authority may be: 

A) (U) For no more than one year for "Foreign Power" targets (establishments); or 

B) (U) For no more than 120 days for a non-USPER agent of a foreign power, with renewals for 
up to one. 

18.7.1.6.2.3 (U) Extension of Physical Search Authority 

(U//FOUO) An extension of physical search authority may be granted on the same basis 
as the original order upon a separate application for an extension and upon new findings 
made in the same manner as the original order. 
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18.7.1.6.2.4 (U) Emergency FISA Authority 

A) (U) The Attorney General may authorize an emergency physical search under FISA when he 
reasonably makes a determination that an emergency situation exists that precludes advance 
FISA court review and approval, and there exists a factual predication for the issuance of a 
FISA Court Order. In such instances, a FISC judge must be informed by the Attorney General 
or his designee at the time of the authorization and an application according to FISA 
requirements is submitted to the judge as soon as is practicable but not more than seven (7) 
days after the emergency authority has been approved by the Attorney General. 

B) (U) If a court order is denied after an emergency authorization has been initiated, no 
information gathered as a result of the search may be used in any manner except if with the 
approval of the Attorney General, the information indicates a threat of death or serious bodily 
harm to any person. 


q n J//FOI fOI For an emergency FISA for nhvsical search! 



1 

1 



18.7.1.6.2.5 (U) Special Circumstances 

(U) The President through the Attorney General may also authorize a physical search 
under FISA without a court order for periods of up to one year, if the Attorney General 
certifies that the search will be solely directed at premises, information, material, or 
property that is used exclusively by or under the open and exclusive control of a foreign 
power; there is no substantial likelihood that the physical search will involve the 
premises, information, material, or property of a United States person; and there are 
minimization procedures that have been reported to the court and Congress. The FBI's 
involvement in such approvals is usually in furtherance of activities pursued according to 
E.0. 12333. Copies of such certifications are to be transmitted to the FISA Court. See 50 
U.S.C. § 1822[a]. 

(U) Information concerning USPERs acquired through unconsented physical searches 
may only be used according to minimization procedures. See: 50 U.S.C. §§ 1824(d)(4) 
and 1825(a). 


-b 7 E 


18.7.1 .6.2.6 (U) Required Notice 

(U) If an authorized search involves the premises of an USPER, and the Attorney General 
determines that there is no national security interest in continuing the secrecy of the 
search, the Attorney General must provide notice to the USPER that the premises was 
searched and the identification of any property seized, altered, or reproduced during the 
search. 


18.7.1.6.2.7 (U//FOUO) FISA Verification of Accuracy Procedures 


(U//FOUCj 

1 
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A) (U//FOUO) Each i nvestigative file for which a n application is prepared for submission to the 
FISC must include l I This sub-file must be used for copies of all of 

the supporting documentation relied upon when making the certifications contained on the 


Lust include: 


1) OJ// FOUOl 



2) (U//FOUO) 


3) (U//FOUO 



B) (U//FOUO) 



18,7.1.6.2.8 (U) Use of FISA Derived Information in Other Proceedings 

(U//FOUO) There are statutory (50 U.S.C. Sections 1806, 1825, and 1845) and Attorney 
General (AG) policy restrictions on the use of information derived from a FISA ELSUR, 
physical search, or PR/TT. These restrictions apply to and must be followed by anyone 
4t who may seek to use or disclose FISA information in any trial, hearing, or other 
proceeding in or before any court, department, officer, agency, regulatory body, or other 
authority of the United States. . . ” See DIOG Appendix E for the AG Memo, Revised 
Policy on the Use or Disclosure of FISA Information, dated 01-10-2008. The guidance in 
the AG’s Memo establishes notification/approval procedures which must be strictly 
followed. Though not contained in the AG Memo. FBI policy requires thaf 


18-162 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 





UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide § 1 8 



1 

(U//FOUO) The United States must, prior to the trial, hearing, or other proceeding or at a 
reasonable time prior to an effort to disclose or use that information or submit it into 
evidence, notify the “aggrieved person” [as defined in 50 U.S.C. Sections 180l(k), 
1821(2), or 1841(2)], and the court or other authority in which the information is to be 
disclosed or used, that the United States intends to disclose or use such information. See 
50 U.S.C. Sections 1806(c), 1825(d), and 1845(c). 

18.7.1.6.2.9 (U//FOUo£ 

(\]//¥OUO) Each investigative file for which an anolication is or has been nrenared for 
submission to the FISC will include a sub-file to be labeled \ 

_|This sub-file is to contain copies of all applications to and 
orders issued by the FISC for the conduct of physical searches in the investigation. The 

following data must be included in thisQ 

A) (U//FOUO£ 

and 

B1 aj//FQUof~ 

nil 

18.7.1.6.2.10 (U//FOUO) FISA Renewals 

(U//FOUO)T 


1 

(UZ/FOUpF 


(UZ/FOUPf" 


1 

18 . 7 . 1 . 6 . 2 . 10.1 (U) Appealing the Decision of the Review Board 

(U//FOUOir 
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18 . 7 . 1 . 6 . 2.12 (U)FISAOvercollection 



b 7 E 
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18.7.2 (U) Investigative Method: Electronic Surveillance- Title III 

18.7.2.1 (U) Summary 

(U//FOUO) Electronic Surveillance (ELSUR) under Title III is a valuable investigative 
method. It is, also, a very intrusive means of acquiring information relevant to the effective 
execution of the FBI’s law enforcement. To ensure that due consideration is given to the 
competing interests between law enforcement and the effect on privacy and civil liberties, this 
section contains various administrative and management controls beyond those imposed by 
statute and DOJ guidelines. Unless otherwise noted, it is the respon sibility of the case agent 
and his/her supervisor to ensure compliance with these instructions.! I 

| i Title III ELSUR 

requires: (i) administrative or judicial authorization prior to its use; (ii) contact with the field 
office ELSUR Technician to coordinate all necessary recordkeeping; and (iii) consultation 
with the Technical Advisor (TA) or a designated TTA to determine feasibility, applicability, 
and use of the appropriate equipment. 



18.7.2.2 (U) Legal Authority 

(U) Title III ELSUR is authorized by chapter 1 19, 18 U.S.C. §§ 2510-2522 (Title III of the 
Omnibus and Safe Streets Act of 1 968). 


18.7.2.3 (U) Definition of Investigative Method 

(U) Title III ELSUR is the non-consensual electronic collection of information (usually 
communications) under circumstances in which the parties have a reasonable expectation of 
privacy and court orders or warrants are required. 

18.7.2.4 (U) Title III Generally 

(U) with the prior approval of the Attorney General, or Attorney General’s designee, the 
United States Attorney, by and through an AUSA, or the Strike Force Attorney, may apply to 
a federal judge for a court order authorizing the interception of wire, oral, or electronic 
communications relating to one or more of the offenses listed in Title III (1 8 U.S.C. § 2516). 
Judicial oversight continues throughout the operational phase of the electronic surveillance 
including the installation, monitoring, and handling of recording media. 

(U) For purposes of obtaining review and approval for use of the method, Title III 
applications are considered to be either “sensitive” or “non-sensitive.” The requirements for 
each are set forth below. 
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18.7.2.5 (U) Standards for Use and Approval Requirements for Non-Sensitive 
Title Ills 

(U//FOUO) An SAC is the authorizing official to approve all requests for “non-sensitive” 
Title m orders, including original, extension, and renewal applications. SAC approval of all 
extensions and renewals is required to ensure that field office managers will allocate the 
resources necessary to use this method. Any delegation of SAC approval authority to an 
ASAC under this section must be in writing. 

(U//FOUO) Prior to SAC approval referred to above, CDC or OGC review is required for the 
initial “non-sensitive” Title III order. Extensions and renewals sought within 30 days after the 
expiration of the original Title III order in non-sensitive Title Ills do not require CDC review, 
unless requested by the SAC or designee. The CDC must review renewals sought more than 
30 days after the expiration of the original Title III order. 

(U//FOUO) There may be situations or unusual circumstances requiring the FBI to adopt an 
already existing Title III from another federal law enforcement agency. Such adoptions may 
only be done on a case-by-case basis, in exceptional circumstances, and subject to the 
requirements set forth herein relating to CDC review and SAC approval. Should the Title III 
proposed for adoption involve sensitive circumstances, it must also be handled in accordance 
with the approval and review requirements set forth below. 

18.7.2.6 (U) Standards for Use and Approval Requirements for Sensitive Title Ills 

(U//FOUO) All Title III applications involving one of the seven “sensitive circumstances,” 
listed below, including all extensions and renewals, must be reviewed by OGC and approved 
by FBIHQ. The SAC, with the recommendation of the CDC, must determine whether the 
request involves sensitive circumstances. The term “sensitive circumstances” as used in this 
section relating to electronic surveillance under Title III is different from the term “sensitive 
investigative matters,” as used in conjunction with approval requirements for opening 
Assessments and Predicated Investigations, and is different from the term “sensitive 
monitoring circumstances” as used in conjunction with the approval requirements for 
consensual monitoring. 

(U//FOUO) The field office must include a copy of the completed CDC checklist (FD-926) 
when forwarding the initial sensitive Title III applications to OGC and FBIHQ for review. 
After the initial submission, the CDC checklist must be completed by the appropriate OGC 
unit for all subsequent extensions or renewals of sensitive Title Ills. 

(U//FOUO) Although ultimate approval for sensitive Title Ills is at the FBIHQ level, the SAC 
or ASAC must continue to review and approve the use of the method for all sensitive Title III 
applications as it relates to the allocation of resources within their field office. 

(U//FOUO) The following five sensitive circumstances require the approval of a Deputy 
Assistant Director (DAD) or a higher level official from the Criminal Investigative Division 
(CID), Cyber Division, Counterterrorism Division (CTD), Weapons of Mass Destruction 
Directorate (WMDD), or Counterintelligence Division (CD), as appropriate: 


18-166 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide § 1 8 

A) (U//FOUO) Significant privilege issues or First Amendment concerns (e.g., attorney-client 
privilege or other privileged conversations or interception of news media representatives); 

B) (U//FOUO) Significant privacy concerns are anticipated (e.g., placing a microphone in a 
bedroom or bathroom); 

C) (U//FOUO) Application is based on ‘‘relaxed specificity” (i.e., “roving” interception) under 18 
U.S.C.§ 2518(1 lXa) and (b); 

D) (U//FOUO) Application concerns a Domestic Terrorism (DT), International Terrorism, or 
Espionage investigation; or 

E) (U//FOUO) Any situation deemed appropriate by the AD of CID or OGC. 

(U//FOUO) The following two sensitive circumstances require the approval of the Director, 
the Acting Director, Deputy Director, or the Executive Assistant Director (EAD) for the 
Criminal Cyber Response and Services Branch or National Security Branch, or the respective 
Assistant Director for Criminal Investigative Division (CID), Cyber Division, 
Counterterrorism Division (CTD), Weapons of Mass Destruction Directorate (WMDD), or 
Counterintelligence Division (CD): 

A) (U//FOUO) "Emergency" Title III interceptions (i.e., interceptions conducted prior to judicial 
approval under 18 U.S.C. § 2518(7)); or 

B) (U//FOUO) It is anticipated that conversations of members of Congress, federal judges, high- 
level federal officials, high-level state executives, or members of a state judiciary or 
legislature will be intercepted. 

(U//FOUO) “Sensitive circumstances” may develop at any point in time during the course of a 
Title III. For example, while an initial application for interceptions might not be considered 
sensitive, conversations intercepted thereafter of a high-level state executive would render any 
subsequent spinoffs, extensions, or renewals “sensitive” Title III requests. 

18.7.2.7 [U) Procedures For Emergency Title III Interceptions 

(U//FOUO) 18 U.S.C. § 25 18(7) provides that any investigative or law enforcement officer, 
specially designated by the Attorney General, Deputy Attorney General, or the Associate 
Attorney General, who reasonably determines that an emergency situation exists that requires 
communications to be intercepted before an order authorizing such interception can, with due 
diligence, be obtained, and there are grounds upon which an order could be entered 
authorizing interception, may intercept such communications. 

(U//FOUO) Section 25 1 8(7) postpones, rather than eliminates the need for judicial 
authorization. If the Attorney General, Deputy Attorney General, or the Associate Attorney 
General authorizes an appropriate FBI official to approve an emergency Title m interception, 
an after-the-fact application for an order approving the interception must be made in 
accordance with Title III to the appropriate Court, and an order obtained, within 48 hours after 
the interception has occurred or begins to occur. 

(U//FQU0f~ | 
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(U) 18 U.S.C. § 2518(7) defines an emergency situation as one involving: 

A) (U) immediate danger of death or serious physical injury to any person, 

B) (U) conspiratorial activities threatening the national security interest, or 

C) (IT) conspiratorial activities characteristic of organized crime. 

(U//FOUO) In all but the most unusual circumstances, the only situations likely to constitute 
an emergency by the Department of Justice (DOJ) are those involving an imminent threat to 
life, e.g., a kidnapping, hostage taking, or imminent terrorist activity. 

18.7.2.7.1 (U) Obtaining Emergency Authorization 
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(U/FOUO) Once the AG or his designee has authorized the Director, or his designee to make 
the determination whether to proceed with the emergency Title III, the government has 48 
hours (including weekends and holidays) from the time the AG granted authorization to apply 
for a court order approving the interception. The field office, in coordination with the AUSA, 
must immediately begin preparing an affidavit, application and proposed order for court 
authorization. 

(U/FOUO) The affidavit in support of the after-the-fact application to the court for an order 
approving the emergency interception must contain only those facts known to the AG or his 
designee at the time the emergency interception was approved. The application must h e 
accompanied by the l I form. 

which must reflect the date and time of the emergency authorization. 

(U/FOUO) The government may also request, at the time it files for court-authorization for 
the emergency, court-authorization to continue the interception beyond the initial 48 hour 
period. If continued authorization is sought at the same time, one affidavit may be submitted 
in support of both requests. However, the affidavit must clearly indicate what information was 
communicated to the AG or his designee at the time the emergency interception was approved 
and what information was developed thereafter. Two separate applications and proposed 
orders should be submitted to the court in this situation - one set for the emergency and one 
set for the extension. If continued interceptions are not being sought, no further authorization 
is needed from OEO. The AUSA should, however, still submit the application, affidavit, and 
order to OEO for review. If continued interceptions are sought, that application, affidavit, and 
order must be reviewed by OEO and approved by DOJ like any other Title III request. In 
either situation, the affidavit must also be submitted through the operational unit for OGC 
review, when time allows. 

ru/Fouoil~ I 
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(U/FOUO) Pursuant to 18 U.S.C. § 25 1 8(7), in the absence of a court order, interception shall 
immediately terminate when the communication sought is obtained or when the application 
for the order is denied, whichever is earlier. In the event an application for approval is denied, 
or in any other case where the interception is terminated without an order having been issued, 
the contents of any wire, oral, or electronic communication intercepted shall be treated as 
having been obtained in violation of Title III, and an inventory shall be served on the person 
named in the application. 




18.7.2.8 (U) Pre-Title III Electronic Surveillance (ELSUR) Search Policy 


(U/FOUO) 18 U.S.C § 2518(l)(e) requires that each application for an order to intercept wire, 
oral, or electronic communications (hereinafter ‘Title III”) contain a statement describing all 



(U) For specific details on how to conduct and document such ELSUR searches, see 
Appendix H. 
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18.7.2.9 (U) Duration of Approval for Title 1U 

(U) Court orders issued pursuant to Title III are for a period not to exceed 30 days. An 
“extension” order may be sought to continue monitoring beyond the initial 30-day period 
without a lapse in time. When a break in coverage has occurred, a “renewal” order may be 
sought to continue monitoring the same interceptees and facilities identified in the original 
order. The affidavit and application in support of an extension or renewal must comply with 
all of the Title III requirements, including approval of the Attorney General or designee. 

18.7.2.10 (U) Specific Procedures forTitle 111 Affidavits 

(U//FOUO) The requirements in 1 8 U.S.C. § 25 18 must be followed when preparing a Title 
III affidavit. The Title III affidavit must include the following information: 

A) (U//FOUO) The identity and qualifications of the affiant must be articulated; 

B) (U//FOUO) For the interception of wire or oral communications, the affidavit must establish 
probable cause to believe a violation of at least one of the offenses enumerated in 18 U.S.C. § 
25 16(1) has been, is being, or will be committed. For the interception of electronic 
communications, the affidavit must establish probable cause to believe that some federal 
felony has been, is being, or will be committed; 

C) (U//FOUO) The affidavit must set forth the identities of those persons, if known, for whom 
there is probable cause to believe they are committing the alleged offenses, even if it is not 
believed they will be intercepted over the target facility. This group of individuals is often 
referred to as the “Subjects.” “Interceptees” may be listed separately; “interceptee” are those 
Subjects who are expected to be intercepted; 

D) (U//FOUO) Probable cause must be current and relevant to the use of the particular facilities 
for which interception is sought; 

E) (U//FOUO) The necessity for the Title III must be articulated. There must be a factual basis 
for concluding that alternative investigative procedures have been tried and failed or a 
demonstration why these procedures appear to be unlikely to succeed or would be too 
dangerous if tried ("boilerplate" statements in this respect are unacceptable); 

F) (U//FOUO) Interceptions must be minimized, as statutorily required; 

G) (U//FOUO) The facility or premises to be intercepted must be described fully, including a 
diagram, if possible, if microphone installation is contemplated (surreptitious entries may not 
be conducted for the purpose of preparing a diagram); 

H) (U//FOUO) Whether the request involves any of the seven (7) “sensitive circumstances”; and 

I) (U//FOUO) A statement describing all previous applications for Title III surveillance of the 
same persons (both subjects and interceptees), facilities or places named in the current 
affidavit. To comply with this requirement, a "search,” e.g., an automated indices search of the 
FBI’s ELSUR Records System (ERS) and the systems of other appropriate agencies, must be 
conducted prior to submitting the Title III affidavit to the DOJ OEO (non-sensitive 
circumstances) or to the responsible FBIHQ operational unit (sensitive circumstances). The 
squad SSA is responsible for verifying that pre-Title 111 ELSUR checks have been completed 
before the affidavit is sent to the court. The ELSUR Operations Technician (EOT) and the 
ELSUR supervisor are responsible for confirming that ELSUR searches were properly 
conducted as set forth in the final affidavit submitted to the court. 
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(U//FOUO) At least 10 days prior to submitting the original Title III request to DOJ OEO, the 
field office must forward an electronic communication to FBIHQ setting forth by separate 
subheading: a synopsis of the investigation; the priority of the investigation within the office; 
the anticipated manpower and/or linguistic requirements and outside support, if any, that will 
be needed; a synopsis of the probable cause supporting the Title III application; the 
prosecutive opinion of the USAO; and description of the interceptees. If a field office is 
unable to submit the EC 10 days prior to submitting the request to DOJ OEO, the field office 
must advise the operational unit immediately and note the circumstances that prevent timely 
notification. 



18.7.2.11 (U) Dispute Resolution for Title III Applications 


(U//FOUO) When there are legal questions/concems that cannot be resolved through 
discussions with reviewing officials at DOJ, the responsible FBIHQ operational division 
supervisors or executives must forward the application to OGC for its review, advice, and 
recommendation. 

18.7.2.12 (U) Notice and Reporting Requirements - Title III 

(U//FOUO) The anticipated interception of conversations related to a “Sensitive Investigative 
Matter” as defined in the AGG-Dom, Part VII.N, requires notice to the appropriate FBIHQ 
Unit Chief and Section Chief, and DOJ Criminal Division. Note : A sensitive investigative 
matter (SIM) is not the same as a sensitive circumstance described above. 
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(U//FOUO) Upon completion of Title III ELSUR activity, thJ ""[ workbook must be 

submitted by EQ U as required by | iFor details on the completion and 

submission ofthj | workbook, seej | 
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18.7.3 (U) Investigative Method: Electronic Surveillance - FISA and FISA 

Title VII (acquisition of foreign intelligence informa tion) 

18.7.3.1 (U) Summary 

(U//FOUO) ELSUR conducted pursuant to the Foreign Intelligence Surveillance Act (FISA) 
is a valuable investigative method. It is, also, a very intrusive means of acquiring information 
relevant to the effective execution of the FBPs national security and intelligence missions. To 
ensure that due consideration is given to the competing interests between national security and 
the effect on privacy and civil liberties, this section contains various administrative and 
management controls beyond those imposed by statute and DOJ guidelines. Unless otherwise 
noted, it is the responsibility of the case agent and his/her supervisor to ensure compliance 
with these instructions. FISA ELSUR is only authorized as an investigative method in the 
conduct of Full Investigations. FISA ELSUR requires: (i) administrative or judicial 
authorization prior to its use; (ii) contact with the field office ELSUR Technician to 
coordinate all necessary recordkeeping; and (iii) consultation with the Technical Advisor 
(TA) or a designated TTA to determine feasibility, applicability, and use of the appropriate 
equipment. 

fUZ/FOUQ) ApplicationA I 

hi F, 


(U) This section is divided below into FISA (18.7.3.2) and FISA Title VII (18.7.3.3). 

18.7.3.2 (U) Foreign Intelligence Surveillance Act (FISA) 

18. 73.2.1 (U) Legal Authority 

(U) 50 U.S.C. §§ 1801-1811 (FISA) and E.0. 12333 § 2.5. 

(U) FISA Amendments Act of 2008 (P.L.No. 110-261). 

18. 73.2.2 (U) Definition of Investigative Method 

(U) FISA is the non-consensual electronic collection of information (usually communications) 
under circumstances in which the parties have a reasonable expectation of privacy and court 
orders or warrants are required. 
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18.7.3.2,3 (U) Standards for Use and Approval Requirements for FISA 

18.73.2.3.1 (U) FISA Request Form 

(U//FOUO) FBIHQ and field office requests for FISC ELSUR orders must use the FISA 
Request Form . Field office requests for FISA orders are submitted and tracked through 
^The FISA request forms, in a question and answer format, have been designed 
to ensure that all information needed for the preparation of a FISC application is provided 
to FBIHQ and to the DOJ. 

18.7.3.2.3.2 (U) Certificate by the Director of the FBI 

(U) Each FISA application must be accompanied by a Certification by the Director of the 
FBI or one of nine other individuals authorized by Congress or the President to provide 
such certifications that: the information being sought is foreign intelligence information; 
that a significant purpose of the electronic surveillance is to obtain foreign intelligence 
information; that such information cannot reasonably be obtained by normal investigative 
techniques; that the information sought is "foreign intelligence information' 1 as defined 
by FISA. The certification must include a statement explaining the certifier's basis for the 
certification. 

(U) Title 50 of the United States Code Section 1804 specifies the Assistant to the 
President for National Security Affairs; E.O. 12139 as amended by E.O. 13383 specifies 
the Director of the FBI, Deputy Director of the FBI, the Director of National Intel ligence, 
the Principal Deputy Director of National Intelligence, the Director of the Central 
Intelligence Agency, the Secretary of State, the Deputy Secretary of State, the Secretary 
of Defense, and the Deputy Secretary of Defense as appropriate officials to make 
certifications required by FISA, The FBI Director has represented to Congress that the 
FBI Deputy Director will only certify FISA’s when the FBI Director is not available to 
do so. 


18.7.3.23.3 (TJ) EMERGENCY FISA AUTHORITY (50 U.S.C. § 1805[F]> 

(U) The Attorney General, on request from the Director of the FBI or his/her designee, 
may authorize an emergency FISA for electronic surveillance when it is reasonably 
determined that an emergency situation exists that precludes advance FISC review and 
approval and that a factual predication for the issuance of a FISA Order exists. A FISC 
judge must be informed by DOJ at the time of the emergency authorization and an 
application must be submitted to that judge as soon as is practicable but not more than 
seven (7) days after the emergency authority has been approved by the Attorney General. 
If a court order is denied after an emergency surveillance has been opened, no 
information gathered as a result of the surveillance may be used as evidence or disclosed 
in any trial or other proceeding, and no information concerning any USPER acquired 
from such surveillance maybe used or disclosed in any manner, except with the approval 
of the Attorney General if the information indicates a threat of death or serious bodily 
harm to any person. 
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18 . 7 . 3 . 2.5 (U//FOUO) Specific Procedures for FISA 


(U//FOUO) FISA related initiation and ren ewal proce dures are contained within the FISA 
Initiation Form which can be found within I br on the Forms section of the NSLB 


E 


1 8.73.2.5. 1 (U//FOUO) FISA Verification of Accuracy Procedures 
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(U//FOUO) There are statutory (50 U.S.C. Sections 1806, 1825, and 1845) and Attorney 
General (AG) policy restrictions on the use of information derived from a FISA ELSUR, 
physical search, or PR/TT. These restrictions apply to and must be followed by anyone 
“who may seek to use or disclose FISA information in any trial, hearing, or other 
proceeding in or before any court, department, officer, agency, regulatory body, or other 
authority of the United States. . . ” See DIOG Appendix E for the AG Memo, Revised 
Policy on the Use or Disclosure of FISA Information, dated 01-10-2008. The guidance in 
the AG’s Memo establishes notification/approval procedures which must be strictly 
followed. Though not contained in the Afi Memo. FRT nnlif.v reniiires fhatl \ 


b'VE 


(U//FOUO) The United States must, prior to the trial, hearing, or other proceeding or at a 
reasonable time prior to an effort to disclose or use that information or submit it into 
evidence, notify the “aggrieved person” [as defined in 50 U.S.C. Sections 1801(k), 

1821(2), or 1841(2)], and the court or other authority in which the information is to be 
disclosed or used, that the United States intends to disclose or use such information. See 
50 U.S.C. Sections 1806(c), 1825(d), and 1845(c). 

18.7.3.2.5.3 (U//FOUO) FISA Electronic Surveillance Administrative Sub- 
file 

(U//FOUO)T I 

tb 7 E 
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A) (U//FOUO)l I 


B) (U//FOUOJ 

1 8.7.3.2,5.4 (U//FOUO) FISA REVIEW BOARD 

tUZ/FOUoJ - 



18.7.3.2.5.4.1 (U) 



b7E 
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1 8 . 73.2.8 (U) Special Circumstances for FISA 

(U) Under 50 U.S.C. § 1802, the President, through the Attorney General, may authorize 
electronic surveillance under FISA without a court order for periods of up to one year, if the 
Attorney General certifies in writing under oath that the surveillance will be solely directed at 
acquiring communications that are transmitted by means that are exclusively between or 
among foreign powers and there is no substantial likelihood of the surveillance acquiring the 
contents of communications to which USPERs are parties. 

1 8 . 73.2 . 9 (U) FISA Overcollection 

qj//FOucnl I 

I Contact NSLB for further guidance regarding the handling of any FISA 

overcollection. 

18.73.2.10 (U) Other Applicable Policies 

18.7 3.2.10.1 (U) FISA 

A) (U//FOUO) CD Policy Guide 

B) (U//FOUO) CTD Policy Guide 

C) (U//FOUO) Investigative Law Unit Library 

D) (U//FOUO) Foreign Intelligence Surveillance Act (FISA) Unit 

18.7.3.3 (U) FISA Title VII (acquisition of foreign intelligence information) 

1 8. 7.33 . 1 (V) Summary 

(U) Titles I and III of the FISA (codified as 50 U.S.C. §§ 1801, et seq.) provide the standard, 
traditional methods of collection against agents of foreign powers (including USPERs and 
non-USPERs) and foreign establishments inside the United States. Title VII of FISA, 
“Additional Procedures Regarding Certain Persons Outside the United States,” provides the 
means to target non-USPERs reasonably believed to be located outside the United States. 

1 8 : 733.2 (U) Legal A uthority 

A) (U) FISA Amendments Act of 2008 (122 Stat 2436) 

B) (U) AGG-Dom, Part V.A.13 

18.733.3 (U) Definition of Investigative Method 

(U) Title VII may be used for conducting FISAs on certain persons located outside the United 
States, 
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18. 7. 3.3 A (U//FOUO) Standards for Use and Approval Requirements for 

Investigative Method 

(U//FOUO) See requirements under DIOG Sections 18.7.1, 18.7.2, and 18.7.3 and 

requirements specified above. 

18.7.3.3.5 (U) Duration of Approval 

(U//FOUO) See requirements under DIOG Sections 18.7.1, 18.7.2, and 18.7.3 above. 

18. 73.3.6 (U//FOUO) Specific Collection Procedures for Title VII 

(U) The relevant procedures (or collections) under Title VII are: 

18.7.33.6.1 (U) Section 702 - Procedures for Targeting Non-U.S. Persons 

(non-USPERs) Who Are Outside the United States 

(U//FOUO) Under Section 702, the Government has the authority to target non-USPERs 
who are located outside the United States if the collection is effected with the assistance 
of an electronic communication service provider, as that term is defined in FISA. This 
section does not require a traditional FISA request. Rather, under this section, the 
Attorney General and the Director of National Intelligence may authorize, for periods of 
up to one year, the targeting of non-United States persons reasonably believed to be 
located outside the United States to acquire foreign intelligence information, provided 
they execute a Certification that is submitted to and approved by the FISC. The 
Certifications are accompanied by an affidavit signed by the FBI Director. In addition, 
the FBI is required to file "Targeting Procedures" that ensure that only non-U.S. persons 
(non-USPERs) reasonably believed to be located outside the United States will be 
targeted for collection and "to prevent the intentional acquisition of any communications 
as to which the sender and all intended recipients are known at the time of the acquisition 
to be located in the United States." Additionally, the statute prohibits targeting any person 
reasonably believed to be located outside the United States for the purpose of obtaining 
the communications of a particular, known person reasonably believed to be in the United 
States. Finally, the FBI is also required to follow 702-specific minimization procedures. 

18.7.3.3.6.2 (U) Section 703 - Certain Acquisitions Inside the United States 

Targeting United States Persons Outside the United States 

(U//FOUO) Under Section 703, the Government has the authority to target USPERs who 
are reasonably believed to be located outside the United States if the collection is effected 
with the assistance of a United States provider and if the collection occurs inside the 
United States. This section only authorizes electronic surveillance or the acquisition of 
stored electronic communications or stored electronic data that requires a court order, 
e.g,, non-consensual collection. FISA 703 is an alternative to traditional FISA electronic 
surveillance (Title I) or physical search (Title III) authority when the facts meet the 703 
criteria. There are two notable differences between Section 703 and traditional FISA 
authorities. First, although the application must identify any electronic communication 
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service provider necessary to effect the acquisition, the application is not required to 
identify the specific facilities, places, premises, or property at which the acquisition will 
be directed. Second, Section 703 allows for the targeting of a USPER who is “an officer 
or employee of a foreign power,” even if the target is not knowingly engaging in 
clandestine intelligence gathering activities, sabotage, or international terrorism. To 
obtain authority to collect information under this section, the FBI must submit a FISA 
request and obtain a FISC order and secondary orders, as needed. The process to obtain 
that order is the same as the standard FISA process. Refer to the FISA Unit’s website for 
further information. Section 703 also allows for emergency authorization. Unlike 
traditional FISA orders, however, surveillance authorized pursuant to this section must 
cease immediately if the target enters the United States. If the FBI wishes to continue 
surveillance of the USPER while he or she is in the United States, the FBI must obtain a 
separate court order under Title l (electronic surveillance) and/or Title 111 (physical 
search) of FISA in order to conduct electronic surveillance or a physical search of that 
USPER while the person is located in the United States. The use of any information 
collected using FISA 703 authority must comply with the applicable minimization 
procedures. 

18.7.3.3.6.3 (U) Section 704 - Other Acquisitions Targeting United States 

Persons Outside the United States 

(U//FOUO) Under Section 704, the Government has the authority to target USPERs who 
are reasonably believed to be located outside the United States if the collection occurs 
outside the United States (i.e., without the assistance of a United States’ electronic 
communication service provider). The statute requires that the FISA court issue an order 
finding probable cause to believe that the USPER target is a foreign power, an agent of a 
foreign power, or an officer or employee of a foreign power and is reasonably believed to 
be located outside the United States "under circumstances in which the targeted United 
States person has a reasonable expectation of privacy and a warrant would be required if 
the acquisition were conducted in the United States for law enforcement purposes.” To 
obtain authority to collect information under this section, the FBI must submit a FISA 
request and obtain a FISC order (the order will not include secondary orders). The 
process to obtain a FISA 704 order is similar to, but more streamlined than, that for 
obtaining a traditional FISA under the standard FISA process. There are two notable 
differences between Section 704 and traditional FISA authorities. First, the application is 
not required to identify the specific facilities, places, premises, or property at which the 
acquisition will be directed. Second, Section 704 allows for the targeting of “an officer or 
employee of a foreign power” even if the target is not knowingly engaging in clandestine 
intelligence gathering activities, sabotage, or international terrorism. Refer to the FISA 
Unit's intranet website for further information. Section 704 also allows for emergency 
authorization. Unlike traditional FISA orders, however, surveillance authorized pursuant 
to this section must cease if the USPER enters the United States but may be re-started if 
the person is again reasonably believed to be outside the United States during the 
authorized period of surveillance. If there is a need to continue surveillance while the 
target is located inside the United States a separate court order must be obtained. The use 
of any information collected using FISA 704 authority must comply with the applicable 
minimization procedures. 
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18.7.3.3.6.4 (U) Section 705 - Joint Applications and Concurrent 

Authorizations 


(U//FOUO) Section 705(a) “joint applications” allow the FISC, upon request of the FBI, 
to approve a joint application targeting an USPER under both Sections 703 and 704 
(authority to collect both when the person is inside and outside the United States). 

(U//FOUO) Section 705(b) provides that if an order has been obtained under Section 105 
(electronic surveillance under Title I of FISA) or 304 (physical search under Title III of 
FISA), the Attorney General may authorize the targeting of the USPER target while such 
person is reasonably believed to be located outside the United States. The Attorney 
General has this authority under E.0. 12333 § 2.5. In other words, when the FISA Court 
authorizes surveillance of an USPER target, the Attorney General, under Section 705(b) 
and E.0 12333 § 2.5, can simultaneously authorize surveillance to continue if the target 
travels outside the United States during the authorized period of the surveillance. 

According to Section 705(b), there is no need for a separate order pursuant to Section 703 
or 704. During the FISA drafting process, an FBI employee should determine whether 
surveillance or physical search may occur for purpose of acquiring foreign intelligence 
while the person is reasonably believed to be outside the United States. If so, the FBI 
employee should consult with an OGC or DOJ-NSD attorney to ensure that appropriate 
language is added to the application. 

(U//FOUO)| 1 E 


18.73.3.6.5 (U) FISA Overcollection 
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19 (II) ARREST PROCEDURE POLICY 


19.1 (U) Arrest Warrants 

1 9.1.1 (13) Complaints 

(U) A complaint is a written statement of the facts necessary to establish probable cause to 
believe that an offense has been committed and that the defendant committed it. A complaint is 
presented under oath before a magistrate judge, who may issue an arrest warrant or a summons 
for the defendant if he/she finds the complaint establishes probable cause to believe the 
defendant committed the charged offense. 

1 9.1.2 (13) Arrest Warrants 

(U) Any justice, judge or magistrate judge of the United States has the authority to issue arrest 
warrants for any offense against the United States. In addition, if a federal judge is not available 
any justice of a state supreme court, mayor of a city, state or local judge, justice of the peace, or 
other magistrate of any state where the offender may be found can issue such warrants as long as 
he/she is neutral, detached and capable of deciding probable cause. Copies of warrants issued 
under this authority are returned to the court of the United States that has jurisdiction over the 
offense. 


19.1.3 (U) Jurisdiction 

(U) Federal rules do not limit the application for an arrest warrant to any specified district. 
Usually, an application for a warrant will be made in the district where the offense was 
committed, but it may also be issued by a magistrate judge in the district where the offender is 
located. 

1 9.1 A (13) Person to be Arrested 

(U) An arrest warrant must contain the name of the defendant or, if his/her name is unknown, 
any name or description by which the defendant can be identified with reasonable certainty. 

There is no requirement to determine the defendant’s true name before a warrant can be issued. It 
is sufficient to develop facts which provide a reasonable belief that a particular individual is the 
offender. A warrant can be based on facts that provide a distinguishing physical description or 
describe the particular circumstances in which the defendant can be found. 
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19.2 (U) Arrest with Warrant 


192.1 (U) POLICY 

(U) Whenever possible, an arrest warrant must be obtained prior to an arrest. SSAs may 
authorize Agents 19 to execute arrest warrants and, in extraordinary circumstances, FBIHQ should 
be notified in advance of the arrest. For example, SSA’s should notify FBIHQ when the arrest 
may have a significant impact on an investigation in another field office or when the arrest is 
likely to cause widespread publicity due to the identity or status of the arrestee or the nature of 
the crime. 

(U) Upon the execution of an arrest warrant, the apprehending field office/division must 
promptly enter a “locate” within NCIC. The 00 of the warrant must enter a “clear” within NCIC 
within 24 hours of the “locate.” See the NCIC Field Division Guide, Q145PG for detailed NCIC 
policy. 


1 922 (U) Prompt Execution 

(U) While there is no time limit on the execution of arrest warrants (unlike search warrants), as a 
general rule Agents should make the arrest without prolonged delay after obtaining the warrant. 


1 92.3 (U) Arrest Plans 

(U) The SAC is responsible for ensuring that arrests are carefully and thoroughly planned. 

Proper planning and preparation for arrest situations can greatly enhance the safety and 
effectiveness of Agents and officers during these high-risk situations. Whenever possible, written 
arrest plans must be prepared prior to conducting law enforcement activities that may result in 
the arrest of a potentially dangerous subject. Arrest plans must address five topics: Situatio n. 
Mission, Execution, A dministration and Equipment, and Control and Communications. Th j I 

Imust be utilized 


wnenever possible, wnen briefing the arrest plan, the briefing Agent should stress to the 
participants of the operation that any arrest has the potential to become dangerous. Exigent 
circumstances may necessitate an oral briefing in lieu of a written plan, but the oral briefings 
must address the five topics required to be included in written plans. The planning and execution 
of arrests, raids, and searches should be assigned to experienced Agents. All arrest plans must be 
approved by ASACs or their designees. 


(U) The SSA may consider utilizing, and/or alerting local authorities to the planned arrest, if 
appropriate under the circumstances. Although the time of notification is left to the discretion of 
the SSA, he/she must consider the jurisdiction of local law enforcement, its responsibility to its 
community and its need to be aware of law enforcement actions in its jurisdiction. 


19 (U) The term “Agent'’ in the context of this section includes FBI Special Agents and other federal state, 
tribal, or local law enforcement officers who have been deputized under either Title 18 or 21 of the United 
States Code and are working on behalf of or at the direction of the FBI, e.g. task force officer, JTTF, etc. 


b7E 
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1 9.2.4 (U) Joint Arrests 

(U) An SSA may authorize a joint arrest with state and local authorities. United States Marshal’s 
Service (USMS), or other federal law enforcement agencies. In circumstances of joint arrests, the 
SAC remains responsible to ensure that there is a well-considered arrest plan. 

1 9.2.5 (U) Possession and Display of Warrant 

(U) If time permits, the arresting Agent should have the arrest warrant in his/her possession and 
show it to the defendant at the time of arrest. If the Agent does not have the warrant with him/her 
at the time of arrest, the Agent must inform the defendant of the offense(s) charged and that a 
warrant has been issued. The Agent must, at the defendant’s request, obtain the warrant and 
show it to the defendant as soon as practicable. 

19.3 (U) Arrest without Warrant 

1 9.3.1 (U) Federal Crimes 

(U) Whenever possible, SAC and USAO authority must be obtained before making a warrantless 
arrest. Agents are authorized to make warrantless arrests for any federal crime (felony or 
misdemeanor) committed in their presence. Agents also have authority to make warrantless 
felony arrests for a crime not committed in the presence of the Agent if there is probable cause to 
believe the person to be arrested committed a federal felony. A warrantless arrest must only be 
made when sound judgment indicates obtaining a warrant would unduly burden the investigation 
or substantially increase the potential for danger or escape. (See Non-Federal Crimes below) 

1 9.3.2 (U) Notification to U.S. Attorney 

(U) When a warrantless arrest has been made, the United States Attorney’s Office (USAO) must 
be contacted immediately for authorization to prosecute. 

1 9.3.3 (U) Non-Federal Crimes 

(U) There is no federal statutory authority for Agents to intervene in non-federal (state) crimes. 
FBI policy permits certain types of non-federal arrests in exigent circumstances. 

(U) As a general rule, an Agent should only make an arrest for a state crime if a serious offense 
(felony or violent misdemeanor) has been committed in his or her presence and immediate action 
by the Agent is necessary to prevent escape, serious bodily injury, or destruction of property. 

(U) Agents are also authorized to arrest a person who is the subject of an FBI Predicated 
Investigation when a state or local arrest warrant for that person is outstanding, and the person is 
encountered during the investigation and would likely escape if not arrested. Similarly, an Agent 
working with state or local law enforcement officers who request assistance to apprehend a 
nonfederal fugitive who has been encountered during the course of a federal investigation is 
authorized to provide the requested assistance when intervention is otherwise permitted for a 
state crime as described in the preceding paragraph. 
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(U) In some states, there is legislative authority for an Agent to intervene in certain types of state 
crimes as a peace officer rather than as a private citizen. Deputization as a state peace officer 
allows a federal Agent to make arrests for state offenses with the authority and immunities of a 
law enforcement officer of the state or one of its subdivisions. Of greater significance is whether 
intervention by an Agent in a particular nonfederal crime falls within the scope of employment. 
Agents who intervene in serious nonfederal crimes committed in their presence or who arrest a 
state fugitive under the circumstances previously described will normally be considered to be 
acting within the scope of their employment. While the determination to provide legal 
representation depends on the facts and circumstances of each circumstance, the DOJ, as a 
general rule, will provide legal representation to Agents who act in accordance with this policy. 

(U) It is important to note that the DOJ has indicated that efforts to enforce minor infractions of 
the law, such as shoplifting or traffic violations, are not generally considered to be within the 
scope of employment. Civil actions against federal personnel concerning acts which fall outside 
the scope of employment will not be removed to federal courts, and employees in such 
circumstances will not be eligible for legal representation provided for by the DOJ. An Agent’s 
status with respect to civil liability in such circumstances will depend on a particular state's law, 
which may require an employee to defend himselfTherself as an ordinary citizen. 

(U) See LHBSA Section 9 for a discussion of potential civil liability when making nonfederal 
arrests. 


1 9.3.4 (U) Adherence to FBI Policy 

(U) If any official in the US AO instructs an Agent to arrest or detain a subject in any manner 
contrary to FBI rules and regulations, the Agent must not comply with such instructions and 
must immediately inform the SSA. (See the special rules in Section D.13 below for the arrest of 
juveniles.) 

19.4 (U) Prompt Appearance before Magistrate 

(U) When a federal arrest is made, the arrestee must be taken before the nearest available federal 
magistrate judge without unnecessary delay. If a federal magistrate judge is not available, the 
arrestee may be brought before a state or local judicial officer authorized by 1 8 U.S.C. § 304 1 
after consultation with the USAO. 

(U) Special Considerations for UFAP Arrests : If the arrestee was arrested on a warrant charging 
only a violation of UFAP, the arrestee can be transferred without unnecessary delay to the 
custody of the appropriate state or local authorities in the district of arrest. The USAO in the 
originating district will move promptly to dismiss the UFAP warrant. It is not necessary to wait 
until the UFAP warrant has been dismissed to release the subject to state or local authorities, but 
it is important for the Agent to ensure that the USAO dismisses the UFAP warrant promptly after 
the arrest. 

(U) If an Agent makes a warrantless arrest, a complaint must be filed setting forth the probable 
cause. The complaint is generally submitted when the arrestee is brought before the magistrate. 

A personal, telephonic, or electronic presentation to the magistrate of the facts setting forth the 
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probable cause must occur within 48 hours of a warrantless arrest if the arrestee is detained and 
an initial appearance cannot be held within that 48-hour period. 

1 9.4.1 (V) Definition of Unnecessary Delay 

(U) Rule 5 of the Federal Rules of Criminal Procedure requires the arresting agent to bring the 
accused before a federal magistrate judge without unnecessary delay. What constitutes 
“unnecessary delay” is determined in light of all the facts and circumstances. Confessions 
obtained from defendants during periods of unnecessary delay prior to initial appearance are 
generally inadmissible at trial. A voluntary confession that occurs within six (6) hours of arrest is 
admissible if the delay of the initial appearance would be the sole reason for suppression. The six 
hour period begins when the accused is arrested or taken into custody by federal law 
enforcement authorities on a federal charge and runs continuously. The six-hour safe harbor can 
be extended to include delays found by the trial judge to be reasonable considering the means of 
transportation and the distance to be traveled to the nearest available magistrate judge. Delay for 
the purpose of conducting interrogation will not be excused. Delays for many other reasons are 
justified and not grounds for suppression, particularly when there is no indication that the 
purpose of the delay was to extract a confession. For example, courts have found delays beyond 
six hours to be justified when attributable to the defendant’s need for medical treatment, his 
intoxication, the officers’ need to remain at the scene, the unavailability of a magistrate, and 
booking or other legitimate police procedures unrelated to interrogation. 

(U) To avoid the risk that a court will determine that delay beyond the safe-harbor period was 
“unnecessary” and suppress a confession elicited more than six (6) hours after arrest, Agents 
who want to continue or resume an interrogation after six (6) hours must seek a waiver of the 
right to prompt presentment from the accused. To continue an interrogation after six hours have 
elapsed, Agents must advise the suspect of his Rule 5 rights, and seek an affirmative waiver of 
those rights from him. The warning and waiver must be substantially in accord with this 
approved waiver language: 

(V) " You have a right to be taken without unnecessary delay to court, where a judge will 
advise you of the charges against you and provide you with a copy of any affidavit the 
government has filed in support of these charges . The judge will also advise you of the 
rights I advised you of previously, namely, that you have a right to an attorney and to 
have an attorney appointed for you; that you have a right to remain silent and that any 
statement you make may be used against you . The judge will also tell you that you have a 
right to a preliminary hearing, at which the government will have to establish that the 
charges in the complaint are supported by probable cause. The judge will also tell you 
about the factors that will determine whether you can be released from custody prior to 
trial Do you understand this right and are you willing to waive it and continue to talk to 
us?" 

(U) It is prudent to obtain a waiver of the right to prompt presentment in any circumstance when 
interrogation extends beyond the six-hour safe-harbor period. 

19.4.2 (U) Effect of Unnecessary Delay 

(U) Incriminating statements obtained during any period of unnecessary delay after arrest and 
prior to the initial appearance before a magistrate are subject to suppression. 
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1 9 A3 (U) Necessary Delay 

(U) If the delay in bringing an arrested person before the magistrate judge is greater than six 
hours and a confession is obtained after six hours , the government has the burden of proving the 
delay was reasonable. Factors which could contribute to a reasonable delay are the means of 
transportation, the distance to the nearest available magistrate judge and the time and day of the 
week of the arrest. 

1 9AA (U) Initial Processing 

(U) Following an arrest, the defendant should be brought to the nearest FBI office for 
fingerprinting, photographing, and an interview, where appropriate. Other law enforcement 
offices may be used for this purpose if FBI facilities are not reasonably available. This process 
generally should not exceed six hours, measured from the time of arrest to the time of arrival 
before the magistrate judge. 

19A.5 (U) Collection of DNA after Arrest or Detention 

(U) The Attorney General has directed the FBI to collect DNA samples from all arrestees, other 
than juveniles, and all non-U.S. persons (non-USPER) lawfully detained. A DNA sample should 
ordinarily be obtained during initial processing. FBI DNA collection kits should be used to 
collect a saliva sample from inside the person’s mouth. 

(U) There is no requirement to obtain a DNA sample from an individual who is arrested on an 
UFAP warrant when that individual will be turned over to the appropriate state/local agency with 
the expectation that the UFAP charge wilt be dismissed. A DNA sample should not be obtained 
from an individual arrested on a UFAP warrant when there is no expectation of federal 
prosecution. For example, when it is anticipated that the UFAP charge will be dismissed and the 
individual turned over to the appropriate state/local agency, no DNA sample should be obtained. 

(U) A DNA sample may not be taken from a juvenile arrestee. A DNA sample may only be 
taken from a juvenile after he/she has been convicted of certain drug or violent offenses. 

(U) Federal law requires covered individuals to provide a DNA sample as a condition of pre-trial 
release and imposes criminal liability for failing to cooperate in the collection of the sample. 

(U) The law also authorizes “such means as are reasonably necessary to detain, restrain, and 
collect a DNA sample from an individual who refuses to cooperate in the collection of the 
sample.” If resistance is encountered, agents must seek to elicit the cooperation of the individual 
to collect the sample. If the individual continues to resist, agents must advise the USAO or the 
judge and seek a judicial order requiring the individual to cooperate. If the individual still 
continues to resist after the court order, agents may use reasonable force to overcome resistance 
and safely obtain the DNA sample. 

(U) For additional information on the process of collecting DNA samples from arrestees, see EC 
dated, 1 1/20/2009 from Laboratory to All Field Offices (3 1 9T -HQ-A 1 48 7667-LAB) . 
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19.5 (U) Use of Force 

19.5.1 (U) Identification 

(U) An arresting Agent should identify himself/herself before effecting the arrest, in a clear, 
audible voice, as a Special Agent of the FBI and state his/her intention to arrest the subject. 

1 9. 5.2 (U) Physical Force 

(U) Agents are permitted to use the amount of physical force reasonable and necessary to take 
custody and overcome all resistance of the arrestee, and to ensure the safety of the arresting 
Agents, the arrestee and others in the vicinity of the arrest. 

(U) See FBI Deadly Force Policy - DIOG Appendix F. 

1 9.5.3 (U) Restraining Devices 

(U) Temporary restraining devices, such as handcuffs, shackles and/or belts may be used to 
secure an arrestee. Use of such devices is lawful and proper, and Agents are expected to employ 
reasonable judgment under the circumstances in the use of these devices and to resolve any 
doubt in favor of their use. 

1 9. 5.4 (U) Pregnant Arrestees 

(U) Within the standard operational procedures designed to ensure the successful completion of 
an operation and its immediate objectives, and while also guarding the safety of all involved, 
reasonable precautions and techniques should be employed when dealing with an arrestee 
reasonably believed to be pregnant to avoid harm to the fetus. This caution includes actions 
involving confrontation, apprehension, employing restraints, transporting and confining the 
individual, and respond promptly to needed or requested medical care. In particular, reasonable 
care or precautions should be considered and used, if appropriate under the circumstances, when 
employing physical restraints that directly constrict the area of the fetus. 

19.6 (U) Manner of Entry 

1 9.6.1 (U) Knock and Announce 

(U) Agents are required by law to "knock and announce” their identity, authority and purpose, 
and demand to enter before entry is made to execute a arrest warrant. This is part of the 
"reasonableness" requirement of the Fourth Amendment. The announcement can be given by one 
Agent and need not be lengthy or elaborate but must convey to the person behind the door what 
is occurring. A loud announcement is essential and electronic devices designed to amplify the 
voice should be used where communication is anticipated to be difficult. The "knock and 
announce" requirement need not be complied with when the Agent executing the warrant has a 
reasonable suspicion of one or more of the following; 

A) (U) to "knock and announce" would cause the Agent and/or another to be placed in imminent 
peril of bodily harm; 
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B) (U) to "knock and announce" would be a useless or futile gesture as the persons within the 
premises already know of the Agent’s identity, authority, and purpose; 

C) (U) to "knock and announce 1 ’ would cause the evidence sought under the warrant to be 
destroyed or removed; or 

D) (U) to "knock and announce" would permit the escape of the person the Agent seeks to arrest. 

19.6.2 (U) Suspect's Premises 

(U) In order to lawfully enter a suspect's premises to effect an arrest, Agents must have either; (i) 
consent to enter, (ii) an emergency ("hot pursuit") justifying a warrantless entry, or (iii) an arrest 
warrant and probable cause to believe the suspect is in the premises. In determining whether a 
location is the suspect’s premises, an apartment, hotel, motel or boardinghouse room becomes the 
principal residence of the person renting or leasing such premises. If the suspect is not named on 
the lease or rental agreement, the premises may still be considered the suspect's premises if the 
suspect occupies the premises jointly with another. 

1 9.6.3 (U) Third Party Premises 

(U) In order to lawfully enter a third party's premises to arrest a suspect, Agents must have 
either: (i) consent to enter, (ii) an emergency ("hot pursuit") justifying a warrantless entry, or (iii) 
a search warrant for the third party premises describing the person to be arrested. For these 
purposes, a 4t third party premises” is any private premise which is not the principal residence of 
the person to be arrested. For example, a search warrant would be necessary if the arrestee is an 
overnight guest, casual visitor, or temporary caller at the premises of the third party. In order to 
make an entry to arrest, whether premised on an arrest warrant, search warrant, or exigent 
circumstances, the Agent must have probable cause to believe the suspect to be arrested is within 
the premises being entered. 

1 9. 6.4 (U) Exigent Circumstances 

(U) If an Agent has a reasonable belief that the subject will flee before a warrant can be obtained, 
or there is a substantial likelihood that the subject will dispose of evidence before a warrant can 
be obtained or there is increased danger to Agents or others if entry is delayed to obtain a 
warrant, exigent circumstances exist which may justify entry into premises to make a warrantless 
arrest or entry into third party premises without a search warrant to make an arrest. 

19.7 (U) Search Incident to Arrest 

(U) The authority to search incident to an arrest is an exception to the warrant requirement. 

Under this exception, an Agent may conduct a full and complete search of the person of the 
arrestee and the area within the arrestee’s “immediate control.” Immediate control means “the 
area from within which he might gain possession of a weapon or destructible evidence.” Once an 
arrestee has been secured and can no longer reach into the area to be searched, there is no longer 
justification for a warrantless search. The purpose for the exception is to protect the arresting 
Agent, prevent escape, and preserve any evidence in possession of the arrestee. The right to 
search flows from the fact of arrest, not the nature of the crime for which the arrest has been 
made. 
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19.7.1 (U) Prerequisite: Lawful Arrest 

(U) For a search incident to arrest to be lawful, the arrest itself must be lawful, i.e. probable 
cause must exist. Agents can maximize the likelihood that an arrest and search will survive a 
motion to suppress by obtaining an arrest warrant before effecting the arrest. As discussed below, 
entry into a subject’s premises to arrest may also affect the validity of a search incident to arrest. 

(U) Entry into Suspect's Premises: Any entry into premises in order to affect an arrest must be 
lawful. If entering the defendant's premises to effect the arrest, Agents must have either (i) 
consent to enter, (ii) an emergency ("hot pursuit"), or (iii) an arrest warrant and probable cause to 
believe that the defendant is inside the premises. 

1 9. 7.2 (U) Scope and Timing Requirement 

19.7.2.1 (U) Scope of Search 

(U) The Agent is entitled to search the person of the arrestee and the area within the arrestee's 
immediate control at the time of arrest for weapons, to prevent concealment or destruction of 
evidence, and to prevent concealment of any means of escape. The search may include any 
portable personal property in the arrestee's actual possession, such as clothing, purses, 
briefcases, grocery bags, etc. Items of personal property that are accessible to the arrestee, 
such as an unlocked desk drawer or unlocked suitcase, may be searched. Absent an 
emergency, inaccessible or locked items of personal property may not be searched. If there is 
probable cause to believe such items contain evidence, they may be seized, but the Agent 
must obtain a search warrant prior to opening the item. Once an arrestee has been secured and 
can no longer reach into the area to be searched, there is no longer justification for a 
warrantless search 

19.7.2.1.1 (U) VEHICLES 

(U) The interior passenger compartment of a vehicle may be searched incident to a recent 
occupant’s arrest only if the arrestee is within reaching distance of the passenger compartment 
at the time of search or if it is reasonable to believe the vehicle contains evidence of the 
offense for which the person was arrested. Absent one of these factors, a warrantless search of 
an arrestee’s vehicle is unlawful. For example, a search of the vehicle incident to an arrest 
would not be permitted after the occupant has been removed, handcuffed, and placed in a 
nearby Bureau vehicle if the arrest was based on an outstanding arrest warrant for failure to 
appear. If a search of a vehicle incident to arrest can be done under these factors, the 
permissible scope can include unlocked or otherwise accessible containers, such as glove 
compartments, luggage, bags, clothing, etc. 

1 9. 7.2. 1.2 (U) Protective Sweep 

(U) Agents may conduct a protective sweep of the areas immediately adjacent to the site of 
the arrest for the purpose of locating persons that may pose a threat to the safety of the Agents 
or others. Additionally, a protective sweep of other areas beyond those immediately adjacent 
to the site of the arrest may be conducted if the Agents have a reasonable suspicion, based on 
specific and articulable facts, that an individual who poses a danger to those present is in the 
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area to be swept. Reasonable suspicion must be based on facts known to the Agents, such as 
noises in an attic or the at-large status of a dangerous associate. A protective sweep must be 
limited to a brief inspection of those areas within the premises in which a person could hide. 

If an Agent observes evidence in plain view while conducting a protective sweep, the 
evidence may be seized under the plain view doctrine. 

19.7.2.2 (U) Timing 

(U) A search incident to arrest must be made contemporaneous to the time and place of arrest 
and before the arrestee is removed from the area. A farther more thorough search of the 
arrestee at the FBI office or some other place to which the arrestee is transported is also 
permitted as a search incident to arrest. Additionally, Agents may make protective sweeps as 
described above at the time of arrest. 

19.73 (U) Inventory of Personal Property 

(U) Items of personal property removed from a person who has been arrested and is to be 
incarcerated should be carefully inventoried and promptly, thoroughly searched by Agents prior 
to being stored for safekeeping. The inventory must include the contents of containers such as 
purses, shoulder bags, suitcases, etc. 

(U) If Agents have probable cause to believe evidence or contraband is in a locked container, a 
search warrant must be obtained absent emergency circumstances. This is the case because such 
a search is investigatory in nature. It also falls outside what is permitted as a search incident to 
arrest because the contents of a locked container are not immediately accessible to the arrestee. 

(U) Agents do not need a warrant to conduct an inventory search of a lawfully seized container 
removed from an arrestee’s person. Agents may not, however, conduct an inventory search 
solely for investigative purposes. The inventory search must strictly adhere to standardized 
criteria and procedures for collection of property. 

19.8 (U) Medical Attention for Arrestees 

(U) If a person in FBI custody complains of sickness or ill health or if it is reasonably apparent to 
Agents that such a condition exists, arrangements should be made to afford such persons medical 
attention without delay. Agents must also be mindful of the health and well-being of any 
pregnant subject and make arrangements for medical attention when asked or when it is 
reasonably apparent that the subject or fetus needs medical attention. If the time required to 
obtain medical care may result in the passing of more than six hours between arrest and 
presentment, Agents must document the basis for and the receipt of any medical attention given 
to the arrestee. 

19.9 (U) Arrest of Foreign Nationals 

1 9.9.1 (U) Requirements Pertaining to Foreign Nationals 

A) (U) When a foreign national is arrested or detained, the arresting agent must advise him/her of 
the right to have his/her consular officials notified. 
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B) (U) In some situations, the nearest consular officials must be notified of the arrest or detention 
of a foreign national, regardless of the national's wishes. 

C) (U) Consular officials are entitled to access to their nationals in detention and are entitled to 
provide consular assistance. 

1 9 . 9.2 (U) Steps to Follow When a Foreign National is Arrested or 

Detained 

(U) The arresting agent must determine the foreign national's country of citizenship. In the 
absence of other information, the arresting agent must assume that the country of citizenship is 
the country on whose passport or other travel documents the foreign national travels. 

(U) If the foreign national's country is not on the mandatory notification list below: 

A) (U) The arresting agent must promptly offer to notify the foreign national’s consular officials 
of the arrest/detention. For a suggested statement to the foreign national, see Statement 1 
below. 

B) (U) If the foreign national asks that consular notification be given, the arresting Agent must 
promptly notify the nearest appropriate consular official of the foreign national's arrest, 

(U) If the foreign national's country is on the list of mandatory notification countries: 

A) (U) The arresting agent must promptly notify the nearest appropriate consular official of the 
arrest/detention. 

B) (U) The arresting agent must tell the foreign national that this notification will be made. A 
suggested statement to the foreign national is found at Statement 2 below. 

(U) The arresting agent must keep a written record (EC or FD-302) in the investigative file that 
he/she provided appropriate notification to the arrestee and of the actions taken. 

Mandatory Notification Countries and Jurisdictions 

Algeria Guyana Saint Lucia 


Antigua and Barbuda Hong Kong 20 

Armenia Hungary 

Azerbaijan Jamaica 


Saint Vincent and the 
Grenadines 

Seychelles 

Sierra Leone 


20 (U) Hong Kong reverted to Chinese sovereignty on July 1, 1997, and is now officially referred to as the Hong 
Kong Special Administrative Region. Under paragraph 3(f) (2) of the March 25, 1997, U.S.-China Agreement 
on the Maintenance of the U.S. Consulate General in the Hong Kong Special Administrative Region, U.S. 
officials are required to notify Chinese officials of the arrest or detention of persons bearing Hong Kong 
passports in the same manner as is required for persons bearing Chinese passports- i.e., immediately and, in 
any event, within four days of the arrest or detention. 
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Mandatory Notification Countries and Jurisdictions 


Bahamas 

Kazakhstan 

Singapore 

Barbados 

Kiribati 

Slovakia 

Belarus 

Kuwait 

Tajikistan 

Belize 

Kyrgyzstan 

Tanzania 

Brunei 

Malaysia 

Tonga 

Bulgaria 

Malta 

Trinidad and Tobago 

China 21 

Mauritius 

Tunisia 

Costa Rica 

Moldova 

Turkmenistan 

Cyprus 

Mongolia 

Tuvalu 

Czech Republic 

Nigeria 

Ukraine 

Dominica 

Philippines 

United Kingdom 22 

Fiji 

Poland (non-permanent residents 
only) 

U.S.S.R 

Gambia 

Romania 

Uzbekistan 

Georgia 

Russia 

Zambia 

Ghana 

Saint Kitts and Nevis 

Zimbabwe 


Grenada 


21 (U) Notification is not mandatory in the case of persons who carry "Republic of China" passports issued by 
Taiwan. Such persons must be informed without delay, that the nearest office of the Taipei Economic and 
Cultural Representative Office ["TECRO"), the unofficial entity representing Taiwan's interests in the United 
States, can be notified at their request 

22 (U] Mandatory notification is required for nationals of the British dependencies Anguilla, British Virgin 
Islands, Bermuda, Montserrat, and the Turks and Caicos Islands. Their nationals carry United Kingdom 
passports. 
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1 9 . 93 (U) Suggested Statements to Arrested or Detained Foreign 

Nationals 

19.9.3.1 (U) Statement 1: When Consular Notification is at the Foreign National's 
Option 

(U) You are entitled to have us notify your country's consular representatives here in the 
United States that you have been arrested or detained. A consular official from your country 
may be able to help you obtain legal counsel and may contact your family and visit you in 
detention, among other things. If you want us to notify your country’s consular officials, you 
can request notification now or at any time in the future. After your consular officials are 
notified, they may call or visit you. Do you want us to notify your country's consular 
officials? 

19.9.3.2 (U) Statement 2: When Consular Notification is Mandatory 

(U) Because of your nationality, we are required to notify your country’s consular 
representatives here in the United States that you have been arrested or detained. After your 
consular officials are notified, they may call or visit you. You are not required to accept their 
assistance, but they may be able to help you obtain legal counsel and may contact your family 
and visit you in detention, among other things. We will notify your country’s consular 
officials as soon as possible. 

1 9 . 9.4 (U) Diplomatic Immunity 

(U) Diplomatic representatives of foreign governments in the United States may not be arrested. 
Agents may not enter the office or dwelling of a diplomat or a person with diplomatic immunity 
for the purpose of making an arrest, search, or seizure. 

19.9.4.1 (U) Territorial Immunity 

(U) All embassies, legations, and consulates have territorial immunity. Consequently, no 
Agent may attempt to enter any embassy, legation, or consulate for the purpose of making an 
arrest, search or seizure. This territorial immunity extends to both the offices and residences 
of ambassadors and ministers, but only to the office of a consul. A consul’s residence does not 
enjoy territorial immunity. 

19.9.4.2 (U) Personal Immunity 

(U) Ambassadors and ministers, members of their staffs and domestic servants, and the 
immediate family members of a diplomatic officer have personal immunity, as do the 
immediate family members of the administrative and technical staff of a diplomatic mission. 
Consequently, no Agent should attempt to arrest or detain any such person. The personal 
immunity applies to the staffs, domestic servants and immediate family members, regardless 
of citizenship. Ordinarily, consuls do not have personal immunity from arrest on 
misdemeanor charges. If the arrest of a consul is contemplated, immediately notify FBIHQ by 
telephone or electronic communication before any action is taken so that an appropriate check 
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can be made with the Department of State to determine whether the consul involved has any 
special immunity. 

19.10 (U) Arrest of News Media Members 

(U) Attorney General approval must be obtained prior to seeking an arrest warrant for or 
arresting a member of the news media who is suspected of committing any federal offense in the 
course of, or arising out of, the coverage or investigation of a news story, or while engaged in the 
performance of official news media duties. 

(U) Requests for the approval must be submitted to the AD of the operational FBIHQ division 
that is responsible for the investigative classification and the AD of the Office or Public Affairs 
(OP A) by an EC. The requesting EC must be reviewed by the CDC and approved by the SAC 
after coordination with the local USAO. The EC must set forth the facts believed to establish 
probable cause and the investigative justification for the arrest, consistent with the DOJ 
guidelines set forth in 28 C.F.R. § 50.10. 

(U) In emergency circumstances, an Agent may arrest a member of the news media without prior 
AG approval, if authorized by the SAC and the USAO. In such situations, the SAC must 
immediately notify the AD of the FBIHQ operational division, the AD of the OP A, and the 
General Counsel of the arrest, the emergency circumstances that justified proceeding without 
prior authorization and all of the information that would have been provided if prior 
authorization had been sought. The AD of the operational division must promptly notify the 
appropriate officials at DOJ as established in 28 C.F.R § 50.10. After these oral notifications 
have been made, the field office must provide written documentation to the FBIHQ operational 
AD as soon as practicable, but not more than 24 hours after the arrest. FBIHQ must provide 
appropriate written documentation to the DOJ approval authorities to whom oral notice was 
given. 

19.1 1 (U) Arrest of Armed Forces Personnel 

(U) The Uniform Code of Military Justice authorizes any commanding officer exercising general 
court-martial jurisdiction to surrender military personnel under the officer's command to civil 
authority when the person has been charged with a civil offense. A request for surrender must be 
accompanied by: 

A) (U) A copy of the indictment, presentment, information, or warrant; 

B) (U) Sufficient information to identify the person sought as the person who allegedly 
committed the offense; and 

C) (U) A statement of the maximum sentence which may be imposed upon conviction. 

(U) Receipts for persons surrendered for civil prosecution should be signed by an official in the 
USAO, not by an FBI employee. 
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19.12 (U) Arrest of Juveniles 

19.12.1 (U) Definition 

(U) A violation of 18 U.S.C. § 922(x)(2) or violation a federal law which would have been a 
crime, if committed by an adult, by a person who has not attained his/her 1 8th birthday is an act 
of juvenile delinquency. For the purpose of juvenile delinquency proceedings, a juvenile is a 
person who committed a crime before his/her 18 th birthday who has not attained his/her 21 st 
birthday at the time charges are commenced. 

1 9.12.2 (U) Arrest Procedures 

(U) Prearrest procedures applicable to adults (discussion with USAO, filing of complaint, 
issuance of warrant) also govern arrests of juveniles. After arrest, however, the Federal Juvenile 
Delinquency Act requires strict compliance with the following procedures: 

A) (U) Advice of Rights - The arresting Agent must immediately advise the arrested juvenile of 
his/her "legal rights" in language comprehensible to the juvenile. The rights found on the 
standard Form FD-395 meet this requirement. The arresting Agent may obtain a signature 
waiving his/her rights only if the Chief Division Counsel (CDC) or the USAO, based on the 
law of the circuit, has approved interrogation of the juvenile. 

B) (U) Notification to U.S. Attorney’s Office and Juvenile's Parents - The arresting Agent 
must immediately notify the USAO and the juvenile's parents, guardian, or custodian, that the 
juvenile has been arrested. The juvenile’s parents, guardian, or custodian must also be notified 
of the juvenile’s rights (use the FD-395 for this purpose) and the nature of the alleged offense 
for which the juvenile was arrested. 

C) (U) Initial Appearance before Magistrate Judge - Subsequent to his/her arrest, the juvenile 
must be taken to a magistrate judge forthwith. 

D) (U) Record of Notification and Appearance - Because proof of timely notification to the 
juvenile’s parents and prompt appearance before the magistrate judge is essential, Agents must 
promptly prepare FD-302(s) documenting the time the following events occurred: 

1 ) (U) The juvenile was arrested; 

2) (U) The juvenile was advised of his/her rights; 

3) (U) The USAO was notified; 

4) (U) The juvenile’s parents, guardian, or custodian were notified of the arrest and of the 
juvenile’s rights; and 

5) (U) The juvenile was taken before a magistrate judge. 

E) (U) Interrogation and Interviews - Whether a juvenile may be interrogated between arrest 
for a federal offense and initial appearance before the magistrate judge depends on the law of 
the circuit in which the arrest occurs. If interrogation is not permitted in the circuit of arrest, 
information volunteered by the arrested juvenile concerning his/her guilt must be recorded in 
the Agent's FD-302. Clarifying questions may be asked if necessary to be certain what the 
juvenile intended to convey. The volunteered statement may be reduced to writing if such 
action does not delay the juvenile’s appearance before the magistrate judge. A juvenile may 
always be questioned concerning the guilt of someone else, if such questioning does not delay 
bringing him/her before the magistrate judge. These rules apply only when the juvenile has 
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been arrested for a federal offense. They do not apply when the juvenile is suspected of having 
committed a federal offense but is under arrest by state or local officers on a state or local 
charge. 

F) (U) Fingerprinting and Photographing - Agents may not fingerprint or photograph a 
juvenile unless he/she is to be prosecuted as an adult. Because it is not known at the time of 
arrest whether the juvenile will be prosecuted as an adult or a juvenile, Agents may not 
fingerprint or photograph a juvenile without permission of the magistrate judge. Following an 
adjudication of delinquency based on an offense which* if committed by an adult, would be a 
felony that is a crime of violence or a violation of 2 1 U.S.C. § 841 (manufacturing, 
distributing, dispensing of a controlled substance or possession with the intent to do same), § 
955 (possession of controlled substances on board vessels arriving in or departing the United 
States) or § 959 (manufacture or distribution of controlled substances for purpose of unlawful 
importation), the juvenile must be fingerprinted and photographed. Agents should coordinate 
fingerprinting and photographing with the USMS. 

G) (U) DNA Collection - Agents must not take DNA samples from juveniles at the time of arrest. 

H) (U) Press Releases - Neither the name nor picture of an arrested juvenile may be made public. 
Accordingly, the arrest of a juvenile may only be announced by a press release that does not 
contain identifying information. 


u 
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20 (U) OTHER INVESTIGATIVE RESOURCES 

ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 

20.1 (U) Overview where shoot otherwise 


(U) Other investigative resources described below are available as specified in Assessments and 
Predicated Investigations. The investigative resources include: 

20.1.1 ( U//FOUO j |~ 

(U) See Section 20.2 below. 


20.1.2 (U//FOUO)\ 

(U) See Section 20.3 below. 


20.1.3 (U//FOUO) Behavioral Analysis - Operational Behavioral Support 

Program 

(U) See Section 20.4 below. 


20.1.4 (U//FOUO) Sensitive Technical Equipment 

(U) See Section 20.5 below. 


20.2 (U//FOUO)[ 


(S) 


1 

1 

20.2.1 (U) Authorized Investigative Activity 


( U//FOUOJ 

1 

1 1 



ml 


20.3 (U//FOUO) 
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Jfhe program reports the 
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20.4 (U//FOUO) Operational Behavioral Support Program - CIRG's 
Behavioral Analysis Units (BAUs) and/or CD's Behavioral Analysis 
Program 

20.4. 1 (U) Authorized Investigative Activity 

(U) The National Center for the Analysis of Violent Crime (NCAVC) manages and directs the 
FBI’s operational behavioral support across all investigative programs. In addition, the 
NCAVC’s units provide operational and analytical support, without charge, to federal, state, 
local, tribal, foreign law enforcement, intelligence and security agencies involved in the 
investigation of unusual or repetitive violent crimes, communicated threats, terrorism, and other 
matters. The NCAVC also provides support through expertise and consultation in non-violent 
matters, such as national security, corruption, and white-collar crime investigations. See DIOG 
Section 12 for FD-999 documentation and other requirements for Assistance to Other Agencies. 

(U) Requests for NCAVC operational assistance should be made to the NCAVC Coordinator in 
the field office or to the NCAVC unit at Quantico. Requests for service can be coordinated 
through direct contact, telephone, email or Electronic Communication to the NCAVC. All FBI 
operational behavioral support requests must be coordinated and approved by the NCAVC. 

(U) The appropriate Legal Attach^ office (Legat) or the International Operations Division (IOD) 
must coordinate all requests from foreign law enforcement, intelligence and security agencies 
with NCAVC staff. NCAVC staff will assist the Legat or IOD preparation of an appropriate 
request for service and will facilitate the delivery of the service requested from the foreign 
agency. 

(U) For additional information regarding the services provided by NCA VC . 

20.5 (U//FOUO] Sensitive Technical Equipment 

(U//FOUO) Definition : Sensitive Technical Equipment (STE) is defined in the classified ^ . 

provisions in DIOG Appendix G. 


20.5.1 (U) Authorized Investigative Activity 



20.3.1 (U) Authorized Investigative Activity 
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| Refer to the Extraterritorial Guidelines (see DIOG Section 13), appropriate 
Policy Implementation Guides, and OTD policy for additional information. 
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21 (U) INTELLIGENCE COLLECTION 


21.1 (U) Incidental Collection 



21.2 (U) FBI National Collection Requirements 


(U//FOUO) The FBIHQ DI establishes FBI national collection requirements after coordination 
with OGC, other FBIHQ operational divisions, and field offices. An FBI national collection 
requirement describes information needed by the FBI toe (i) identify or obtain information about 
potential targets of, or vulnerabilities to, Federal criminal activities or threats to the national 
security; or (ii) inform or facilitate intelligence analysis and planning pertinent to the FBI’s law 
enforcement or national security missions. 
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(U//FOUO) Before any investigative activity is conducted in order to respond to an FBI national 
collection requirement, an Assessment or Predicated Investigation must be opened or already 
open. An Assessment cannot be opened solely based upon an FBI national collection 
requirement. An authorized purpose (national security or criminal threat) and clearly defined 
objectives) must exist prior to opening an Assessment. During an Assessment, the FBI is 

authorized to collect against any FBI national collection requirement that k relevant m 

Assessment. | 
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2 1.3 (U/ /FOUO) FBI Field Office Collection Requirements 

(U//FOUO) An FBI field office collection requirement describes information needed by the field 
to: (i) identify or obtain information about potential targets of or vulnerabilities to Federal 
criminal activities or threats to the national security; or (ii) inform or facilitate intelligence 
analysis and planning pertinent to the FBI’s law enforcement or national security missions. 

(U//FOUO) Before any investigative activity may be conducted to respond to an FBI field office 
collection requirement, an Assessment or Predicated Investigation must be opened or already 

open. An As sessment cannot be opened solely based upon an FBI field office 

requirement.1 
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